What is the CVSS score of CVE-2026-3601?

CVE-2026-3601 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

User Registration & Membership CVE-2026-3601

EUVD-2026-27241 MEDIUM

Missing Authorization (CWE-862)

2026-05-05 Wordfence

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 09:00 vuln.today

DescriptionCVE.org

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the embed_form_action() function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to append shortcode content to arbitrary pages they do not own or have permission to edit.

AnalysisAI

The User Registration & Membership plugin for WordPress versions up to 5.1.4 allows authenticated attackers with Contributor-level access to append shortcode content to arbitrary pages without authorization due to a missing capability check in the embed_form_action() AJAX function. This enables privilege escalation where lower-privileged users can inject content into posts and pages owned by other users or administrators, potentially defacing sites or injecting malicious content.

Technical ContextAI

The vulnerability exists in the embed_form_action() AJAX handler within the User Registration & Membership WordPress plugin. WordPress AJAX functions execute with the authenticated user's capabilities, and this handler fails to verify whether the requesting user has edit_post or equivalent capability for the target page before allowing content modification. CWE-862 (Missing Authorization) defines this class of flaw: the plugin checks authentication (user is logged in) but omits authorization checks (user has permission to edit this specific resource). The affected code is in class-ur-ajax.php and related admin assets files, where shortcode embedding operations proceed without wp_verify_nonce() validation or current_user_can() capability checks against the target post.

RemediationAI

Update the User Registration & Membership plugin to a patched version released after 5.1.4 (exact version number not specified in provided data, but WordPress plugin administrators should check for available updates via the WordPress dashboard). The upstream fix, visible in the plugin's Trac repository changeset 3485702, adds proper capability checks via wp_verify_nonce() and current_user_can() calls to the embed_form_action() function. As a temporary compensating control, site administrators can restrict Contributor role permissions by removing the ability to use shortcodes or embed forms via role management plugins (e.g., User Role Editor), though this may limit legitimate contributor functionality. Alternatively, disable the User Registration & Membership plugin entirely until patched if the embedding feature is not critical.