CVE-2026-80072

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

Score

CVSS 3.1 4.7 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-13

Last modified

2026-09-13

Weaknesses

CWE-601

Affected products

• User Registration Membership (Unknown)

References

• https://wpscan.com/vulnerability/0af2c06d-87a0-4be7-a409-ffb7ad958aad/