User Registration Membership CVE-2026-11961

Exploitation requires the site to expose a public (unauthenticated) registration form from the plugin and the target privileged role to be bound to a membership tier that is published; the attacker manipulates the membership-tier value submitted during registration, which the plugin fails to validate against the form's allowed tiers. The escalation ceiling depends on which roles are mapped to published tiers - reaching administrator specifically requires an administrator-associated tier to exist and be published (the AC:H factor). Limiting factors: if no privileged tier is published or mappable, impact is capped at the available low-privilege tiers, and sites without open public registration are not exposed via this path. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine high-priority issue where the attacker prerequisites are met. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) reflects unauthenticated network exploitation with full CIA impact, tempered by AC:H - the worst-case admin outcome requires that an administrator-capable membership tier actually exists and is published, which is not a default. Public exploit code exists (WPScan), raising practical risk, but the vulnerability is not on CISA KEV and no active exploitation is confirmed, so treat it as high-likelihood-once-targeted rather than confirmed widespread exploitation. No EPSS score or SSVC decision data was provided in the input, so probabilistic exploitation ranking cannot be cross-referenced against these signals. The AC:H caveat matters: sites that only map tiers to low-privilege roles face materially lower impact than the worst-case administrator-tier scenario.

An attacker visits a WordPress site running the plugin, opens a public membership registration form, and submits the request while tampering with the membership-tier parameter to reference a higher-privilege published tier such as an administrator-mapped one. Because the server does not validate the tier against the form's allowed set, the new account is granted that tier's role, potentially yielding full administrative control. Public exploit code from WPScan lowers the barrier to reproducing this.