EUVD-2026-95729
GHSA-92m4-mg5f-62gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
ExploitSend request to restricted resource
-
ExecutionBypass missing authorization check
-
ImpactRead protected member content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Restrict User Access - Membership Plugin with Force to be installed with access-control 'security levels' that are incorrectly configured, as the vulnerability stems from improper enforcement on misconfigured access levels; this configuration dependency is the primary limiting factor. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication or user interaction is needed and attack complexity is low once a vulnerable, misconfigured instance is reachable over the network. Impact is bounded to unauthorized read access to restricted content (C:L only); no write/integrity or availability effect. Affected versions are all releases through 2.8.1. |
| Impact | This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) indicates a remote, unauthenticated, low-complexity attack with no user interaction, but the impact is limited to a low confidentiality breach only - no integrity or availability impact. This aligns with CWE-862 (Missing Authorization): the flaw lets attackers reach content that should be gated behind the plugin's access-control levels. Several key risk signals are MISSING from the provided data: there is no EPSS score, no CISA KEV listing, and no public POC reference, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The disclosure comes from Patchstack, a credible WordPress-focused source, but the single reference is a Patchstack database entry rather than a vendor advisory, so affected-version data is from Patchstack/NVD rather than DEV Institute directly. The low confidentiality-only impact plus absence of exploitation evidence means this should be patched in routine cycles, not treated as an actively-exploited priority. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to a WordPress site running the vulnerable plugin and, because of the missing authorization check on incorrectly configured access-control security levels, retrieves members-only or otherwise restricted content they should not be able to view. No public exploit code was identified in the provided data, and the impact is limited to unauthorized disclosure of protected content (C:L), not modification or site takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.
RemediationAI
No fixed version is identified in the supplied advisory data, so the immediate action is to treat every release at or below 2.8.1 as vulnerable and check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/restrict-user-access/vulnerability/wordpress-restrict-user-access-membership-plugin-with-force-plugin-2-8-1-broken-access-control-vulnerability?_s_id=cve) and the plugin's vendor page for a released update, then upgrade as soon as one is published - vendor patch status should be treated as unconfirmed until an exact fixed version is published. Because exploitation hinges on incorrectly configured access levels rather than a purely unconditional bypass, the highest-value compensating control is to audit every membership/security level in the plugin and verify that each protected page, post, and custom post type is explicitly assigned to an appropriately restricted level, correcting any levels left at permissive or default settings; the trade-off is that this is a configuration fix, not a code fix, so an undiscovered misconfiguration still leaves the site exposed. Where the plugin's functionality is not essential, deactivating and removing it eliminates the attack surface entirely, at the cost of losing membership gating until an alternative is deployed. Sites that must keep the plugin can reduce exposure by placing sensitive restricted content behind an additional layer (server-level auth, IP allowlisting, or a second membership mechanism), which duplicates access control and adds administrative overhead, and by monitoring for bulk or unauthenticated access to restricted URLs, which detects abuse but does not prevent it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
At the root is CWE-862 (Missing Authorization), a broken access control class in which a component fails to verify that the requester is entitled to the resource before returning it. In WordPress membership/restriction plugins, access rules are expressed as "security levels" or membership levels that map content to permitted roles; this plugin defines such levels but does not reliably enforce them when the level configuration is not the expected/default shape, so the restriction check can be skipped and protected content served to any requester. The provided CPE (cpe:2.3:a:dev_institute:restrict_user_access_-_membership_plugin_with_force:*:*:*:*:*:*:*:*) identifies the affected component as the DEV Institute "Restrict User Access - Membership Plugin with Force" WordPress plugin, matching the WordPress plugin slug restrict-user-access. Because the vector is AV:N/AC:L/PR:N/UI:N, the flaw is reachable over the network without credentials or victim interaction, but the configuration dependency - incorrectly configured access levels - means exploitation is only viable on instances that already have a misconfigured level in place. The low-severity confidentiality-only score (S:U/C:L/I:N/A:N) reflects information disclosure of restricted content rather than privilege escalation, code execution, or data modification.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated missing-authorization flaw (AV:N/PR:N/UI:N/AC:L) that only discloses restricted content, so C:L with I:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in DEV Institute Restrict User Access - Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access - Membership Plugin with Force: from n/a through 2.8.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB