What is the CVSS score of CVE-2026-11961?

CVE-2026-11961 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of User Registration Membership are affected by CVE-2026-11961?

The User Registration & Membership WordPress plugin (versions before 5.2.3) contains a privilege escalation vulnerability allowing unauthenticated attackers to self-assign administrator role during…. A patch is available.

Is there a public PoC exploit available for CVE-2026-11961?

Yes, a public proof-of-concept exploit is available for CVE-2026-11961. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11961?

Within 24 hours, update the User Registration & Membership plugin to version 5.2.3 or later across all affected WordPress installations. Within 7 days, audit membership tier configurations, review all administrator and high-privilege account activity for unauthorized modifications, and identify any suspicious account creations. Within 30 days, conduct forensic review of WordPress access logs for registration attempts containing arbitrary tier assignments, and implement form-submission integrity monitoring to detect future tampering attempts.

User Registration Membership CVE-2026-11961

EUVD-2026-45146 HIGH

Improper Privilege Management (CWE-269)

2026-07-17 WPScan

GHSA-55mp-h634-7h25

WordPress Privilege Escalation User Registration Membership Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network exploitation (AV:N/PR:N/UI:N); AC:H because full admin impact needs a published admin-mapped tier to exist; C/I/A:H reflect potential full site takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 14:24 vuln.today

CVSS changed

Jul 17, 2026 - 14:22 NVD

8.1 (HIGH)

Patch available

Jul 17, 2026 - 08:02 EUVD

CVE Published

Jul 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 17, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role - up to administrator when such a tier exists.

AnalysisAI

Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors self-assign an arbitrary published membership tier during public registration, gaining that tier's user role - including administrator where such a tier exists. The plugin never validates that the tier submitted in the registration form is one the form actually offers, so an attacker simply tampers with the submitted tier value. Publicly available exploit code exists (reported by WPScan), though active exploitation has not been confirmed.

Technical ContextAI

The plugin is a WordPress membership solution that maps registration 'membership tiers' to WordPress user roles at account creation. The root cause is CWE-269 (Improper Privilege Management): the server-side registration handler trusts the tier identifier submitted by the client instead of verifying it against the set of tiers exposed by the specific registration form. Because WordPress roles carry capability sets, binding a self-selected tier to a role effectively lets the caller choose their own privileges. The single vague CPE (cpe:2.3:a:unknown:user_registration_&_membership:*) carries no vendor granularity, so affected-scope precision comes from the EUVD version range rather than NVD CPE.

RemediationAI

Upgrade the plugin to version 5.2.3 or later (Vendor-released patch: 5.2.3), which enforces that the submitted membership tier belongs to the tiers the registration form permits. Until patched, the most effective compensating control is to ensure no privileged (administrator or other high-capability) membership tier is published or reachable through any public registration form - unpublish or demote such tiers so the worst-case outcome is limited to a low-privilege role, with the trade-off that legitimate high-tier self-registration stops working. Alternatively, disabling open public registration or gating it behind manual admin approval closes the vector entirely at the cost of registration convenience, and auditing existing accounts for unexpected role assignments will catch prior exploitation. See the WPScan advisory (https://wpscan.com/vulnerability/2ffab574-8626-472e-b6e4-09bcbaa62349/) for details.