CVE-2026-1779

The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.35% chance of exploitation in the next 30 days, 28th percentile

Published

2026-02-26

Updated

2026-04-08

Proof-of-concept exploits (1)

• Hann1bl3L3ct3r/CVE-2026-61450★ · 2026-05-14

References

• CVE Record
• NVD entry

Related

• CVE-2025-3248
• CVE-2026-11349
• CVE-2026-1492
• CVE-2026-25895
• CVE-2026-4056
• CVE-2026-4112