User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder CVE-2026-1865

While the CVSS score of 6.5 (Medium) reflects moderate severity, real-world risk is elevated by several factors. The attack vector is Network (AV:N) with Low complexity (AC:L), requiring only low-privileged authentication (PR:L), making exploitation trivial for any authenticated site user. Confidentiality impact is High (C:H), permitting extraction of sensitive user data, membership records, and potentially hashed credentials. The EPSS score is not provided, but the combination of network-accessible vulnerability, low barrier to entry (authenticated but low-privilege), and direct data exfiltration capability suggests this merits rapid patching. The absence of reported active exploitation (KEV status unknown, no POC identified) should not reduce urgency, as SQL Injection in WordPress plugins is a well-established attack pattern with mature exploitation frameworks. The Subscriber-level requirement limits exposure to sites with public registration, but many WordPress sites do permit free user registration.

An attacker with a free Subscriber account on a WordPress site using the vulnerable plugin can craft a malicious HTTP request containing a modified 'membership_ids[]' parameter, injecting SQL syntax such as UNION SELECT statements to retrieve arbitrary data from the wp_users table (usernames, email addresses, password hashes) or other sensitive tables. The low complexity of SQL injection in WordPress contexts, combined with the attacker's authenticated network access, enables rapid execution of data extraction queries without user interaction. No technical proof-of-concept has been publicly released, but SQL injection exploitation in WordPress is well-documented and readily automatable.