The WP Private Content Plus plugin for WordPress has a security vulnerability in versions up to and including 3.1. This means that unauthenticated attackers can create members without proper authentication if they can trick a site administrator into clicking a link.