CVE-2026-86407 is an information exposure vulnerability (CWE-200) in the User Registration & Membership WordPress plugin versions 5.0 up to but not including 5.2.8. The flaw arises from insufficient verification on the membership confirmation page, allowing unauthenticated users to retrieve sensitive user information such as email addresses, profile fields, roles, and membership order details if a user smart tag has been added to the page message. The default plugin configuration does not include this smart tag, limiting the exposure unless the site owner customizes the message accordingly.

The vulnerability allows disclosure of sensitive user information to unauthenticated attackers, potentially leading to privacy violations. However, the impact is limited by the requirement that the site owner must have added a user smart tag to the membership confirmation page message, which is not included by default. The CVSS score is 3.7 (low severity), reflecting limited confidentiality impact and high attack complexity.

Upgrade the User Registration & Membership plugin to version 5.2.8 or later, where this vulnerability is fixed. If immediate upgrade is not possible, ensure that the membership confirmation page does not include user smart tags in its configurable message to prevent information exposure. Monitor vendor advisories for official patches or updates.