CVE-2026-80072: unknown user registration & membership Open Redirect
Vulnerability summary
CVE-2026-80072 is a high (CVSS 7.2) Open Redirect vulnerability in unknown user registration & membership. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 5.2.8.
Timeline
- 13-09-2026PublishedVulnerability first disclosed.
- 13-09-2026Last modifiedVulnerability information updated.
Description
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA4.7MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:NDiffers
- NVDNIST4.7MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
+0.12 pp
From 0.17% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
Wordpress1 product
- user-registration< 5.2.8
2 vendors · 2 products