{"affected":[{"defaultStatus":"unaffected","product":"User Registration & Membership","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"5.2.8","versionType":"semver"}]}],"cveId":"CVE-2026-109870","cwes":["CWE-269"],"description":"The User Registration & Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b/"}],"kev":null,"metrics":[],"modifiedAt":1794376805654,"publishedAt":1794376805654,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b/"}],"remediation":[],"revision":"6d8a1f0466f831ac43a3dca7d7b0e48d0ca0a32c8d4b67e9e54f900b6085acda","sources":[{"modifiedAt":1794376805654,"name":"CNA: WPScan","retrievedAt":1794377308126,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109870"}],"ssvc":null,"status":"published","title":"User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass","updatedAt":1794377308126}