CVE-2026-16736

Summary

The flaw allows unauthenticated users to bypass registration restrictions set by administrators, enabling account creation even when open registration is disabled.

Exploitability

Exploitation requires access to the WordPress plugin and knowledge of the site's registration settings; relatively easy if an attacker can identify the vulnerable version.

Blast radius

If exploited, it could lead to unauthorized user accounts being created, potentially compromising user data or site integrity.

Prioritized remediation

Update the User Registration & Membership WordPress plugin to version 5.2.6 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.