The User Registration & Membership WordPress plugin before 5.2.2 accepts payment‑provider webhook notifications from PayPal without verifying the authenticity of the messages. Because there is no signature validation, an attacker can forge a “payment approved” event and send it to the plugin’s webhook endpoint, causing the system to activate a paid membership for an arbitrary, unauthenticated user. This grants the attacker the privileges and benefits of a legitimate purchase while incurring no real payment, potentially leading to financial loss and abuse of platform resources.

WordPress installations running the User Registration & Membership plugin older than 5.2.2 are impacted. The plugin is distributed under the name User Registration & Membership and is available via standard WordPress plugin directories; no specific server platform or versions are required beyond the plugin itself.

The CVSS score of 9.1 indicates a critical severity, yet the EPSS score of less than 1% suggests that the vulnerability is not widely exploited at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST to the plugin’s webhook endpoint, where the attacker supplies a forged payment‑approved event. Because the plugin lacks signature verification, any well‑formed request will be accepted, making the vulnerability trivial to exploit in a target environment that has the plugin installed.