The vulnerability CVE-2026-1865 affects the wpeverest User Registration & Membership plugin for WordPress, specifically versions up to 5.1.2. It is caused by improper neutralization of special elements in an SQL command (CWE-89) via the 'membership_ids[]' parameter. Authenticated attackers with at least Subscriber privileges can exploit this flaw by appending malicious SQL queries to existing database commands, potentially exposing sensitive data. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity and requiring low privileges, impacting confidentiality but not integrity or availability. No known exploits in the wild have been reported, and no vendor-provided patch or official remediation is documented.

Successful exploitation allows an authenticated user with Subscriber-level or higher access to perform SQL Injection attacks through the 'membership_ids[]' parameter. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not affect data integrity or availability according to the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges carefully and monitor for suspicious activity related to the 'membership_ids[]' parameter. Avoid granting Subscriber-level access to untrusted users. Follow vendor channels for updates on patches or temporary mitigations.