THREAT OPS › Threat News › [NVD] CVE-2026-86407 (LOW 3.7) — The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve
[NVD] CVE-2026-86407 (LOW 3.7) — The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve
CVE-2026-86407 CVSS: 3.7 LOW Published: 2026-09-13T06:16:25.260
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and
Indicators of compromise
- CVE-2026-86407cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86407