The User Registration & Membership WordPress plugin before version 5.2.2 accepts payment‑provider webhook notifications from PayPal without verifying the authenticity of the messages. Because the plugin does not validate the webhook signature, a message claiming that a payment has been approved can be forged by an external actor and sent to the plugin’s webhook endpoint. When such a forged notification is received, the plugin processes it as a legitimate payment and automatically activates a paid membership subscription for the specified user, even though the payment was never actually made.

WordPress sites that have the User Registration & Membership plugin installed and running a version older than 5.2.2 are impacted. The plugin is commonly distributed through the official WordPress plugin repository, and no additional software or server configuration is required for the vulnerability to be present beyond the plugin itself.

The CVSS score of 9.1 marks this flaw as critical, and the EPSS score of less than 1% indicates that it is not widely exploited at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the plugin’s webhook endpoint, a scenario that can be inferred from the fact that the plugin processes payment notifications without authentication checks. Any well‑formed request containing a fabricated payment‑approved event will be accepted, making exploitation straightforward in a vulnerable environment.