CVE-2026-92978: WordPress User Registration Plugin CSRF Flaw

CVE-2026-92978 Overview

The User Registration & Membership plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 5.2.8. The flaw resides in the trigger_bulk_action function, which lacks proper nonce validation. Unauthenticated attackers can trick a site administrator into clicking a crafted link to approve pending user registrations or deny arbitrary user accounts. Successful exploitation locks legitimate users out of the site and allows unauthorized approval of pending accounts. The weakness is classified as CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can manipulate user account state (approve or deny registrations) by tricking an authenticated administrator into visiting a malicious page, resulting in account lockout and unauthorized membership approval.

Affected Products

WordPress User Registration & Membership plugin versions through 5.2.8
Deployments using the plugin's bulk user management functionality
Sites relying on the plugin for membership approval workflows

Discovery Timeline

2026-10-17 - CVE-2026-92978 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-92978

Vulnerability Analysis

The vulnerability allows unauthenticated attackers to forge requests that execute privileged administrative actions on behalf of a logged-in administrator. The affected trigger_bulk_action() handler in class-ur-admin-user-list-manager.php processes bulk user operations including approval and denial of pending registrations. Because the handler does not verify a CSRF nonce, any administrator who visits an attacker-controlled page while authenticated to WordPress triggers the targeted action. The impact is limited to integrity of user account state; data confidentiality and site availability are not directly affected.

Root Cause

The root cause is missing or incorrect nonce validation on the trigger_bulk_action function. An earlier nonce check exists in trigger_query_actions(), but an attacker can bypass it by supplying an empty new_role parameter. That handler returns early, ceding control to the unprotected trigger_bulk_action() handler. The exit() call at the end of the vulnerable handler also prevents WordPress core's own bulk-users nonce validation from executing. See the User List Manager source for context.

Attack Vector

Exploitation requires an authenticated administrator to perform a user interaction, such as clicking a crafted link or visiting an attacker-controlled page. The attacker hosts a page that auto-submits a forged request to the vulnerable endpoint with an empty new_role parameter and bulk-action parameters targeting selected user IDs. When the administrator's browser issues the request with valid session cookies, the plugin processes the bulk action without validating a nonce. The attacker does not need credentials on the target site. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-92978

Indicators of Compromise

Unexpected approval of previously pending user registrations in the plugin's user list
Legitimate user accounts transitioning to a denied state without administrator action
HTTP POST requests to the admin interface originating from external Referer headers
Access log entries showing bulk-action parameters submitted without a valid _wpnonce value

Detection Strategies

Audit WordPress user metadata changes correlated with administrator browser sessions on external sites
Inspect web server access logs for POST requests to wp-admin endpoints with the ur_user_action or related bulk parameters and empty new_role values
Review plugin activity logs or database audit trails for bulk approve or deny events lacking a corresponding administrator-initiated navigation path

Monitoring Recommendations

Enable WordPress activity logging to capture user approval and denial events with source IP and referrer context
Alert on anomalous bursts of user state changes outside normal administrative hours
Monitor the Referer header on administrative POST requests and flag requests originating from untrusted domains

How to Mitigate CVE-2026-92978

Immediate Actions Required

Update the User Registration & Membership plugin to a version newer than 5.2.8 once available from the vendor
Restrict administrator browsing habits and require separate browser profiles for WordPress administration
Review all pending and denied user accounts for unauthorized state changes since the plugin was installed

Patch Information

The vendor committed a fix in changeset 3741339, which addresses the missing nonce validation in the trigger_bulk_action() handler. Administrators should apply the patched release through the WordPress plugin updater as soon as it is published.

Workarounds

Temporarily deactivate the User Registration & Membership plugin until the patched version is applied
Deploy a web application firewall rule to block POST requests to the plugin's bulk-action endpoint lacking a valid _wpnonce parameter
Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress session cookies to reduce cross-origin request risk
Require administrators to use a dedicated browser or profile for WordPress management to limit CSRF exposure

bash

# Example WAF rule concept blocking bulk-action requests without a nonce
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@contains /wp-admin/users.php" \
  "chain,deny,status:403,id:1092978,msg:'CVE-2026-92978 CSRF block'"
  SecRule ARGS_NAMES "@rx ur_user_action|action" "chain"
    SecRule &ARGS:_wpnonce "@eq 0"