CVE-2026-16736: WordPress User Registration Auth Bypass

CVE-2026-16736 Overview

CVE-2026-16736 is a broken access control vulnerability [CWE-284] in the User Registration & Membership WordPress plugin versions before 5.2.6. The plugin fails to enforce the site's registration-disabled setting when processing registration-form submissions. Unauthenticated attackers can create new user accounts even when administrators have explicitly turned off open registration. The issue exposes affected WordPress sites to unauthorized account creation, which can be leveraged for spam, credential stuffing, or downstream privilege abuse depending on default role assignments.

Critical Impact
Unauthenticated remote attackers can bypass the disabled-registration policy and create arbitrary accounts on affected WordPress installations.

Affected Products

User Registration & Membership WordPress plugin versions prior to 5.2.6
WordPress sites with the plugin installed and open registration disabled
Any deployment relying on the plugin's registration toggle as a security control

Discovery Timeline

2026-08-05 - CVE-2026-16736 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16736

Vulnerability Analysis

The plugin exposes a registration-form submission handler that processes new-user requests without consulting the site's registration-disabled configuration flag. Administrators who disable open registration through the WordPress or plugin settings expect the submission endpoint to reject subsequent registration attempts. In vulnerable versions, that check is missing from the server-side handler.

Because the flaw resides in server-side enforcement, hiding the registration form in the front-end UI does not prevent exploitation. An attacker who crafts a direct POST request to the registration endpoint can trigger account creation regardless of the administrative setting. The vulnerability is network-reachable, requires no authentication, and requires no user interaction.

Root Cause

The root cause is a missing authorization check [CWE-284] in the registration-processing logic. The plugin trusts that the front-end will honor the disabled-registration flag rather than enforcing it in the handler that persists new user records. This is a classic business-logic gap where the security decision is made in the wrong layer.

Attack Vector

Exploitation involves sending a crafted HTTP request to the plugin's registration endpoint with valid form field values. No credentials, tokens tied to an existing user, or social-engineering steps are required. Refer to the WPScan Vulnerability Report for technical details on the affected code path.

No verified proof-of-concept code is publicly indexed at this time, and the vulnerability mechanism is described in prose only.

Detection Methods for CVE-2026-16736

Indicators of Compromise

Newly created WordPress user accounts appearing while the registration-disabled setting is active in wp-admin.
Unexpected POST requests to the plugin's registration endpoint from unauthenticated sources in web server access logs.
Bursts of account creation events originating from a small set of IP addresses or user-agent strings.
Notification emails to the site administrator confirming registrations that should have been blocked.

Detection Strategies

Audit the wp_users table for accounts created after the disabled-registration setting was applied.
Correlate WordPress registration events with the plugin's audit log or WordPress core action hooks such as user_register.
Alert on HTTP POST submissions to the plugin's registration handler while users_can_register is set to 0.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and build a rule for anomalous registration volume.
Track deltas in the total user count on a scheduled basis and flag increases when open registration is disabled.
Monitor outbound activity from newly created accounts for spam posting, comment abuse, or privilege changes.

How to Mitigate CVE-2026-16736

Immediate Actions Required

Update the User Registration & Membership plugin to version 5.2.6 or later on every affected WordPress site.
Review all user accounts created since the plugin was installed and remove or disable any that were not authorized.
Force password resets for accounts that must be retained and validate their email ownership.
Restrict administrative access to the plugin's settings and confirm the registration-disabled toggle after upgrade.

Patch Information

Upgrade to User Registration & Membership plugin version 5.2.6 or later. The maintainers restored server-side enforcement of the registration-disabled setting in this release. See the WPScan Vulnerability Report for release confirmation and additional context.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the plugin's registration endpoint until the patch is applied.
Temporarily deactivate the User Registration & Membership plugin if account creation is not required for site operations.
Restrict access to the registration URL by IP allow-list at the reverse proxy or hosting layer.
Enable CAPTCHA and email verification for any registration flow that must remain reachable during patch planning.

bash

# Example nginx rule to block unauthenticated registration submissions
location ~* /(?:register|user-registration)/? {
    limit_except GET { deny all; }
}