CVE-2026-80072: User Registration WordPress CSRF Vulnerability

CVE-2026-80072 Overview

CVE-2026-80072 is an open redirect vulnerability [CWE-601] in the User Registration & Membership WordPress plugin before version 5.2.8. The plugin fails to validate the destination of a post-login redirect before performing the redirect. Unauthenticated attackers can craft URLs that send visitors to arbitrary external destinations after login. Attackers can abuse this behavior for phishing campaigns that leverage the trust of the legitimate WordPress site domain.

Critical Impact
Attackers can redirect users to attacker-controlled URLs following the login flow, enabling credential phishing and malware distribution under the guise of a trusted site.

Affected Products

User Registration & Membership WordPress plugin versions prior to 5.2.8
WordPress sites running the vulnerable plugin with login functionality exposed
Any deployment relying on the plugin's post-login redirect parameter

Discovery Timeline

2026-09-13 - CVE-2026-80072 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80072

Vulnerability Analysis

The vulnerability is an open redirect classified under [CWE-601] (URL Redirection to Untrusted Site). The plugin accepts a post-login redirect target through a user-controllable parameter. The redirect handler passes this value to the response without validating that the destination points to an allowed host or path.

Because the redirect occurs after the WordPress login workflow, the initial URL displays the legitimate site domain. Users who inspect the link before clicking see a trusted host. After authentication, the browser is sent to the attacker's chosen URL. This trust transfer is the primary reason open redirects remain useful in phishing chains.

The issue requires user interaction, since a victim must click the crafted link and complete or trigger the login flow. No authentication is required on the attacker's side to construct or distribute the malicious URL.

Root Cause

The root cause is missing validation of the redirect destination. The plugin does not enforce an allow-list of internal paths or verify that the target host matches the site's own domain before issuing the HTTP redirect response. Consult the WPScan Vulnerability Report for the technical write-up.

Attack Vector

An attacker crafts a URL pointing to the vulnerable WordPress site's login endpoint, appending a redirect parameter that references an external phishing page. The attacker distributes the URL through email, messaging, or social media. When a victim clicks the link and interacts with the login flow, the plugin redirects the browser to the attacker-controlled destination. The landing page typically mimics the original site to harvest credentials or deliver malware.

Detection Methods for CVE-2026-80072

Indicators of Compromise

Web server access logs containing login requests with external URLs in the redirect parameter
HTTP 302 responses from the plugin's login handler pointing to hosts outside the site's own domain
Referrer chains in downstream systems showing the WordPress login endpoint as the source of traffic to unrelated domains
User reports of unexpected redirects to unfamiliar login or download pages after signing in

Detection Strategies

Inspect query strings on login requests for redirect parameter values containing http://, https://, //, or encoded variants that resolve to external hosts
Correlate WordPress plugin version inventory against the fixed version 5.2.8 to identify vulnerable installations
Alert on outbound HTTP redirect responses from the WordPress origin whose Location header targets non-allowlisted domains

Monitoring Recommendations

Enable verbose access logging on the WordPress front end and forward logs to a central analytics platform for query-based hunting
Monitor threat intelligence feeds and user-reported phishing submissions for URLs referencing the site's login endpoint
Track plugin update status across all managed WordPress sites and flag installations still running versions below 5.2.8

How to Mitigate CVE-2026-80072

Immediate Actions Required

Update the User Registration & Membership plugin to version 5.2.8 or later on all affected WordPress sites
Audit recent access logs for login requests containing external URLs in the redirect parameter and investigate any hits
Notify users who may have been redirected through the vulnerable flow and advise credential resets if phishing is suspected

Patch Information

The vendor addressed the issue in User Registration & Membership version 5.2.8. The fix validates the redirect destination before issuing the response. Refer to the WPScan Vulnerability Report for the advisory reference.

Workarounds

Restrict access to the plugin's login endpoint using web application firewall (WAF) rules that strip or reject external URLs in the redirect parameter
Enforce an allow-list at the reverse proxy layer that only permits redirect targets matching the site's own domain
Temporarily disable the plugin on sites that cannot be updated immediately if login functionality is not business-critical

bash

# Example WAF rule concept: reject login requests where the redirect parameter points off-site
# Adjust parameter name and host to match your deployment
SecRule ARGS:redirect_to "@rx ^(https?:)?//(?!yoursite\.com)" \
    "id:1026800720,phase:2,deny,status:400,msg:'Blocked external redirect target'"