CVE WatchSep 13, 2026

CVE-2026-86407

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pa

CVSS

3.7

Low

EPSS

—

KEV

—

Exploit Today

0-100

Published: Sep 13, 2026 · Last modified: Sep 13, 2026 · CWE-200

EPSS · 30d

Not enough EPSS history yet.

Technical description

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.

Official references

wpscan.comhttps://wpscan.com/vulnerability/2c9eb1fe-4e18-4fd0-9581-5672ffc4b598/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-905032.3 LOW

—

——0A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub_11008 in the library ComputerZ_x64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.9h CVE-2026-889955.3 MED

—

——0The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.7h CVE-2026-777735.3 MED

—

——0The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.7h CVE-2026-905505.3 MED

—

——0WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.1d CVE-2026-905495.3 MED

—

——0WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.1d CVE-2026-905485.3 MED

—

——0WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.1d