CVE-2026-6203: User Registration & Membership WordPress plugin - Open Redirect
HoneyLabs honeypots recorded 6 probes matching CVE-2026-6203 from 2 distinct source IP addresses in the last 7 days, of which 6 on interactive sensors. Severity is rated MEDIUM.
2 sources probed for CVE-2026-6203 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
All of them arrived on one day, 2026-11-12. One address, 211.154.20.136, sent 67% of them. The largest source network was AS146817 (Hubei Feixun Network Co., Ltd), with 67% of the probes from 1 address. Over the last 90 days the sensors recorded 18 probes for it. The probing clients presented 2 distinct TLS fingerprints, most often t13i1811h1_85036bcba153_b26ce05bbdd6.
Request paths that identify it
- /wp-content/plugins/user-registration/readme.txt
- /?user-logout=true&redirect_to_on_logout=https://interact.sh
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 211.154.20.136 | 4 | Hubei Feixun Network Co., Ltd | China |
| 194.165.16.156 | 2 | Flyservers S.A. | Panama |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS146817 | Hubei Feixun Network Co., Ltd | 4 | 1 |
| AS48721 | Flyservers S.A. | 2 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| China | 4 |
| Panama | 2 |
Requests the interactive sensors answered
- GET /wp-content/plugins/user-registration/readme.txt
HTTP client fingerprints
- b11cun050_00040017_976354f0
- b11cun040_00040016_4110f156
CVE report
Open a specific CVE from the CVE tracker.