CVE-2026-109871
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying.