The User Registration & Membership WordPress plugin, in versions before 5.2.8, validates a visitor’s request for its membership confirmation page without checking that the requester owns the referenced account or that a registration or purchase has occurred. This omission permits an unauthenticated user to retrieve another user’s email address, selected profile fields, role, and membership order details when the page’s configurable message contains user‑smart tags. The flaw is a classic information disclosure vulnerability (CWE‑200).

Any WordPress installation that has the User Registration & Membership plugin installed with a version earlier than 5.2.8 and has added user‑smart tags to the membership thank‑you page’s message is affected. The CNA did not identify a vendor, so the plugin’s author or maintenance entity is not explicitly named.

An attacker needs only an unauthenticated HTTP request and can craft a URL to the thank‑you page using a target user identifier. No privileged credentials are required. The CV severity, the EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Because the validation bypass is straightforward, any affected site is vulnerable to data harvesting if the smart tags remain in place.