What is the CVSS score of CVE-2026-4056?

CVE-2026-4056 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4056?

Organizations using Membership should be aware of moderate risk from CVE-2026-4056, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-4056?

Within 30 days: Identify affected systems running for WordPress is vulnerable to unauthorized modification of and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-4056

EUVD-2026-14656 MEDIUM

Missing Authorization (CWE-862)

2026-03-23 Wordfence

GHSA-98m3-qp88-gp9w

Authentication Bypass WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 23:45 euvd

EUVD-2026-14656

Analysis Generated

Mar 23, 2026 - 23:45 vuln.today

CVE Published

Mar 23, 2026 - 23:25 nvd

MEDIUM 5.4

DescriptionCVE.org

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the check_permissions() method only checking for edit_posts capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access.

AnalysisAI

The User Registration & Membership plugin for WordPress contains an insufficient capability check vulnerability in its Content Access Rules REST API endpoints, allowing authenticated contributors and above to bypass intended administrative restrictions. Versions 5.0.1 through 5.1.4 are affected, enabling attackers to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access. The vulnerability has a CVSS score of 5.4 with low attack complexity and low privilege requirements, making it readily exploitable by any authenticated user with contributor-level access or higher.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a root cause where the check_permissions() method in the Content Access Rules REST API controller incorrectly validates user capabilities. The method checks only for the edit_posts capability, which is granted to contributors and above, rather than requiring administrator-level capabilities necessary for managing site-wide content access policies. WordPress capability model treats edit_posts as a relatively permissive capability suitable for content creation but insufficient for system-level configurations. The affected plugin is the User Registration & Membership plugin (identified by CPE cpe:2.3:a:wpeverest:user_registration_&_membership_–_free_&_paid_memberships,_subscriptions,_content_restriction,_user_profile,_custom_user_registration_&_login_builder), which provides content restriction functionality through REST API endpoints in its content-restriction module. The flaw exists in the REST API controller class-urcr-content-access-rules.php file at line 116, where the permission check is implemented.

RemediationAI

Immediately upgrade the User Registration & Membership plugin to version 5.1.5 or later, which includes the corrected check_permissions() method that enforces administrator-level capability checks on the Content Access Rules REST API endpoints. This patch is available directly from the WordPress plugin repository and through automatic update mechanisms within WordPress installations. Site administrators should verify the upgrade completion and confirm that REST API endpoint permission requirements now properly restrict access to administrators only. As a temporary mitigation prior to patching, implement a Web Application Firewall (WAF) rule to restrict access to the /wp-json/urcr/v1/ endpoints to administrator IP addresses only, or disable REST API access entirely for non-administrators through the rest_authentication_errors filter if functionality permits. Review audit logs for any suspicious REST API calls to the affected endpoints from non-administrator accounts to detect prior exploitation attempts.