{"id":"CVE-2026-92978","kind":"vulnerability","aliases":["CVE-2026-92978"],"related":[],"title":"WordPress membership plugin: forged requests approve or deny user accounts","description":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.","summary":"The User Registration & Membership plugin for WordPress, up to and including 5.2.8, has a missing nonce check on its bulk user action handler. An unauthenticated attacker can trick a logged-in administrator into clicking a link that approves pending registrations or denies arbitrary user accounts, locking those users out of the site.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the User Registration & Membership plugin in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version`\n- Treat a version of `5.2.8` or lower as exposed","fix":"- Update the User Registration & Membership plugin to a version later than `5.2.8` (the sources do not name the fixed version: unknown)","status":"open","published_at":"2026-10-17T04:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:39:52+00:00","updated_at":"2026-10-25T04:39:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:39:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the User Registration & Membership plugin to a version later than `5.2.8` (the sources do not name the fixed version: unknown)","reach":"internet","title":"WordPress membership plugin: forged requests approve or deny user accounts","impact":"low","summary":"The User Registration & Membership plugin for WordPress, up to and including 5.2.8, has a missing nonce check on its bulk user action handler. An unauthenticated attacker can trick a logged-in administrator into clicking a link that approves pending registrations or denies arbitrary user accounts, locking those users out of the site.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Arbitrary user accounts get denied and locked out of the site","analyst_note":"","how_to_check":"- Check the installed version of the User Registration & Membership plugin in the WordPress admin plugin list, or with `wp plugin get <plugin-slug> --field=version`\n- Treat a version of `5.2.8` or lower as exposed","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the User Registration & Membership plugin at version 5.2.8 or lower is exposed. The attack needs an administrator to be logged in and to follow a crafted link, so sites with no use of this plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3541,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92978':13A,16A '5.2.8':33B,110C 'account':10A,67B,145C 'action':43B,124C,167C,185C,208C 'addit':219C 'administr':54B,135C,163C 'approv':6A,60B,137C 'arbitrari':65B,143C 'attack':47B,132C,175C 'builder':91C 'bulk':41B,123C,207C,226C 'bulk-us':225C 'bypass':177C 'call':212C 'caus':194C 'cede':201C 'check':38B,181C 'click':56B,170C 'content':83C 'control':202C 'core':222C 'cross':99C 'cross-sit':98C 'custom':87C 'cve':11A,14A 'deni':8A,64B,142C 'due':113C 'earli':199C 'earlier':179C 'empti':189C 'end':215C 'execut':231C 'exit':211C 'forc':134C 'forg':4A,155C 'forgeri':102C 'free':79C 'function':125C 'grant':157C 'handler':44B,196C,209C,218C 'host':20B 'includ':32B,109C 'incorrect':117C 'link':58B,173C 'lock':68B,146C 'log':52B 'logged-in':51B 'login':90C 'make':127C 'membership':2A,25B,78C,81C 'miss':36B,115C 'new':190C 'nonc':37B,118C,180C,228C 'packag':17B 'paid':80C 'paramet':192C 'pend':61B,138C 'perform':165C 'plugin':3A,26B,92C 'possibl':129C 'prevent':220C 'profil':86C 'queri':184C 'registr':24B,62B,77C,89C,140C 'request':5A,101C,156C 'restrict':84C 'return':198C 'role':191C 'self':19B 'self-host':18B 'site':74B,100C,152C,162C 'subscript':82C 'suppli':187C 'target':147C 'trick':49B,160C 'trigger':122C,183C,206C 'unauthent':46B,131C 'unprotect':205C 'user':9A,23B,42B,66B,70B,76C,85C,88C,139C,144C,148C,227C 'valid':119C,229C 'version':105C 'via':153C 'vulner':96C 'wordpress':1A,21B,28B,94C,221C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the User Registration & Membership plugin at version 5.2.8 or lower is exposed. The attack needs an administrator to be logged in and to follow a crafted link, so sites with no use of this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92978","severity":null,"published_at":"2026-10-17T04:17:10+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}