{"id":"CVE-2026-109870","kind":"vulnerability","aliases":["CVE-2026-109870"],"related":[],"title":"WordPress User Registration plugin: coupons let anyone get paid roles free","description":"The User Registration & Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","summary":"The User Registration & Membership WordPress plugin does not check that a discount coupon applies to the paid plan being bought. A fully discounted order is then treated as paid, so an unauthenticated visitor can be given the role tied to that plan without paying, which can reach administrator when a plan maps to an admin role.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["membership-sites","package","user-registration-plugin","wordpress"],"not_affected_if":["no-paid-membership-plans","no-privileged-role-mapped","plugin-version-5.3.2-or-later"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin header of `user-registration/user-registration.php`.\n- Review membership plans in the plugin settings for any plan mapped to a privileged role such as administrator or editor.\n- Check whether discount coupons are in use and whether registration or membership signup is open to the public.","fix":"- User Registration & Membership plugin: `5.3.2` or later (per the description, versions before 5.3.2 are affected).","status":"open","published_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","triaged_at":"2026-11-11T06:28:02+00:00","updated_at":"2026-11-11T06:28:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:28:02Z","model":"claude-haiku-5-5","output":{"fix":"- User Registration & Membership plugin: `5.3.2` or later (per the description, versions before 5.3.2 are affected).","reach":"internet","title":"WordPress User Registration plugin: coupons let anyone get paid roles free","impact":"high","summary":"The User Registration & Membership WordPress plugin does not check that a discount coupon applies to the paid plan being bought. A fully discounted order is then treated as paid, so an unauthenticated visitor can be given the role tied to that plan without paying, which can reach administrator when a plan maps to an admin role.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","user-registration-plugin","membership-sites"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated users gain paid roles, possibly administrator","analyst_note":"","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin header of `user-registration/user-registration.php`.\n- Review membership plans in the plugin settings for any plan mapped to a privileged role such as administrator or editor.\n- Check whether discount coupons are in use and whether registration or membership signup is open to the public.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-5.3.2-or-later","no-paid-membership-plans","no-privileged-role-mapped"],"who_is_affected":"Sites running the User Registration & Membership WordPress plugin before 5.3.2 that sell paid membership plans with discount coupons open to the public. The risk is highest where a paid plan maps to an administrator or other privileged role. Sites without paid plans or coupon-based discounts may not be exposed, but the sources do not confirm the exact conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4579,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109870':14A,17A '-2026':13A,16A '5.3.2':90C 'actual':105C 'admin':81B 'administr':74B,143C 'allow':118C 'anyon':7A 'appli':40B,98C 'bought':46B 'check':35B 'coupon':5A,39B,97C 'cve':12A,15A 'discount':38B,49B,96C,114C 'escal':140C 'free':11A 'fulli':48B,113C 'get':8A 'given':62B 'grant':123C 'lead':137C 'let':6A 'map':78B,126C,148C 'membership':19B,30B,86C,102C 'membership-sit':18B 'order':50B,115C 'packag':21B 'paid':9A,43B,55B,101C,117C,129C 'pay':70B,132C 'plan':44B,68B,77B,103C,109C,130C,146C 'plugin':4A,25B,32B,88C 'privileg':139C,151C 'reach':73B 'registr':3A,24B,29B,85C 'role':10A,64B,82B,125C,152C 'site':20B 'tie':65B 'treat':53B,111C 'unauthent':58B,119C 'user':2A,23B,28B,84C,120C 'user-registration-plugin':22B 'valid':106C 'verifi':93C 'visitor':59B 'without':69B,131C 'wordpress':1A,26B,31B,87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the User Registration & Membership WordPress plugin before 5.3.2 that sell paid membership plans with discount coupons open to the public. The risk is highest where a paid plan maps to an administrator or other privileged role. Sites without paid plans or coupon-based discounts may not be exposed, but the sources do not confirm the exact conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","membershipsites","package","userregistrationplugin","wordpress"],"campaign_type":null,"search_a":"'-109870':14A,17A '-2026':13A,16A 'anyon':7A 'coupon':5A 'cve':12A,15A 'free':11A 'get':8A 'let':6A 'paid':9A 'plugin':4A 'registr':3A 'role':10A 'user':2A 'wordpress':1A","search_b":"'admin':81B 'administr':74B 'appli':40B 'bought':46B 'check':35B 'coupon':39B 'discount':38B,49B 'fulli':48B 'given':62B 'map':78B 'membership':19B,30B 'membership-sit':18B 'order':50B 'packag':21B 'paid':43B,55B 'pay':70B 'plan':44B,68B,77B 'plugin':25B,32B 'reach':73B 'registr':24B,29B 'role':64B,82B 'site':20B 'tie':65B 'treat':53B 'unauthent':58B 'user':23B,28B 'user-registration-plugin':22B 'visitor':59B 'without':69B 'wordpress':26B,31B","search_c":"'5.3.2':90C 'actual':105C 'administr':143C 'allow':118C 'appli':98C 'coupon':97C 'discount':96C,114C 'escal':140C 'fulli':113C 'grant':123C 'lead':137C 'map':126C,148C 'membership':86C,102C 'order':115C 'paid':101C,117C,129C 'pay':132C 'plan':103C,109C,130C,146C 'plugin':88C 'privileg':139C,151C 'registr':85C 'role':125C,152C 'treat':111C 'unauthent':119C 'user':84C,120C 'valid':106C 'verifi':93C 'without':131C 'wordpress':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109870","severity":null,"published_at":"2026-11-11T06:17:10+00:00","modified_at":"2026-11-11T06:17:10+00:00","first_seen_at":"2026-11-11T06:25:39+00:00","fetched_at":"2026-11-11T06:25:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}