User Registration Membership CVE-2026-11963

Requires an authenticated low-privileged account (PR:L) - trivially obtained on the many sites that enable open subscriber self-registration, which is this plugin's primary purpose. The specific prerequisite is that the site runs User Registration & Membership before 5.2.2 with the membership-upgrade action reachable by logged-in non-admin users. Exploitation is limited only by the need for one valid low-privileged login and by the target being on an unpatched version; there is no user-interaction requirement, no admin access needed, and no non-default configuration beyond having the plugin active. Sites that disable self-registration raise the bar to needing a pre-existing subscriber credential.

This is a genuine priority rather than an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) reflects a network-reachable, low-complexity attack requiring only a low-privileged authenticated account and no user interaction - trivially satisfied on any site that allows open subscriber registration, which is the plugin's core use case. Publicly available exploit code (WPScan) lowers the barrier further, and the ability to escalate to administrator makes the C:H/I:H impact realistic. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no confirmation of active in-the-wild exploitation - the current signal is 'exploitable and public' rather than 'observed exploited.' One caveat: the input tags this as 'Information Disclosure,' but the description clearly describes an integrity/authorization (role modification) issue, so the tag understates the true impact - treat this as privilege escalation.

An attacker registers a normal subscriber account on a WordPress site running the vulnerable plugin (or uses any existing low-privileged login). Using the publicly available exploit, they send the membership-upgrade request while supplying their own user ID as the caller-controlled target identifier and a higher role/tier value, causing the plugin to promote their account - potentially to administrator - without any authorization check. The attack is remote, low-complexity, and needs no victim interaction.