CVE-2026-16736 is an improper access control vulnerability (CWE-284) in the User Registration & Membership WordPress plugin versions prior to 5.2.6. The flaw allows unauthenticated attackers to bypass the site's registration-disabled setting and create new user accounts despite the administrator's intent to disable open registration. This vulnerability arises from the plugin's failure to properly enforce access control checks on registration form submissions.

The vulnerability allows unauthenticated attackers to create new user accounts on affected WordPress sites even when registration is disabled by the administrator. This can lead to unauthorized account creation, potentially enabling further abuse depending on the privileges granted to new users. The CVSS score of 7.5 (high) reflects the network attack vector, no required privileges or user interaction, and high confidentiality impact due to unauthorized account creation.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should monitor plugin updates closely and consider disabling or replacing the plugin if open registration must be strictly controlled.