CVE-2026-11964Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/faf55649-8f76-4abf-a6b9-0d0774e22d29/

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Full discourse3 posts

CVE@CVEnew91d
Disclosure
CVE-2026-11964 The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on… https://www.cve.org/CVERecord?id=CVE-2026-11964
Post summary
The text announces CVE-2026-11964, noting a lack of authentication for payment-provider webhook notifications in the User Registration & Membership WordPress plugin. No exploitation, patch, or PoC details are provided.
00010459
57.8K followersView on X
ADK Cyber@ADKCyber90d
Patch
CVE-2026-11964 (CVSS 9.1): User Registration & Membership WordPress plugin before 5.2.2 fails to validate payment webhooks. Update immediately if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/4OPkRY7uHU
Post summary
CVE-2026-11964 exposes a critical flaw in the User Registration & Membership WordPress plugin where payment webhooks are not validated, prompting an immediate update.
0000051
89 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-11964 The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on… https://www.cve.org/CVERecord?id=CVE-2026-11964 ----- Traducción: CVE-2026-11964 El … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑11964, noting that older versions of the User Registration & Membership WordPress plugin lack validation of payment‑provider webhooks, without mentioning exploit details, patches, or active use in the wild.
0000031
92 followersView on X

Explore more

Back to dashboard