What is CVE-2026-16736?
This vulnerability affects the 'User Registration & Membership' WordPress plugin before version 5.2.6. It allows unauthenticated attackers to create new user accounts via registration form submissions, even when the site's registration is disabled by the administrator. Updating the plugin to the latest version is recommended.
Azərbaycanca: Bu zəiflik 'User Registration & Membership' WordPress plugin-in 5.2.6-dan əvvəlki versiyalarına təsir edir. Hücumçu, administrator tərəfindən qeydiyyat deaktiv edilsə belə, autentifikasiya olunmadan yeni istifadəçi hesabı yarada bilər. Plugin-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
Which WordPress plugin does CVE-2026-16736 affect?
This vulnerability affects the 'User Registration & Membership' WordPress plugin.
What can an attacker exploiting CVE-2026-16736 do even if registration is disabled by the administrator?
An attacker can create new user accounts without authentication even when registration is disabled by the administrator.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.