EUVD-2026-43284
GHSA-qxg2-gwhj-546g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable action needing only a low-privileged authenticated account (PR:L) and no interaction; role rewrite to admin yields high confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-privileged user (e.g. a subscriber) alter another account's WordPress role and membership tier. The membership-upgrade action performs no authorization check and trusts a caller-supplied user identifier instead of the current session, so an attacker can target an arbitrary account - including their own - to gain higher roles up to administrator. Publicly available exploit code exists and a vendor patch is available, but this is not listed in CISA KEV.
Technical ContextAI
The affected component is the User Registration & Membership plugin for WordPress, which manages account signup, roles, and paid/tiered membership levels. The flaw is a Broken Access Control / Insecure Direct Object Reference issue (CWE-862 Missing Authorization combined with CWE-639 IDOR; the input lists CWE as N/A): the membership-upgrade handler neither verifies that the caller is authorized to modify the target account nor binds the operation to the authenticated user, instead reading the user-to-modify from a request parameter. Because WordPress role capabilities gate nearly all administrative functionality, being able to rewrite another user's role effectively hands the attacker whatever privileges that role carries. Per the EUVD data the issue affects all versions from 0 up to but not including 5.2.2 (cpe:2.3:a:unknown:user_registration_&_membership:*).
RemediationAI
Vendor-released patch: upgrade the User Registration & Membership plugin to version 5.2.2 or later, which restores the authorization check and binds the membership-upgrade action to the authenticated user; this is the definitive fix (see the WPScan advisory at https://wpscan.com/vulnerability/a34a916a-983e-48a5-8f10-99214ee3b613/). If immediate patching is not possible, reduce exposure by disabling open self-registration (Settings > General > 'Anyone can register') so attackers cannot obtain the subscriber accounts the exploit requires - trade-off: this blocks legitimate signups and the plugin's membership onboarding flow. As a further compensating control, restrict or WAF-filter access to the plugin's membership-upgrade endpoint/AJAX action and audit the wp_users/usermeta tables for unexpected role or membership-tier changes; trade-off: endpoint blocking may break legitimate upgrade functionality for paying members. Rotate or review any accounts that were escalated before patching.
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated att
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holdin
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) expo
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), th
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today