EUVD-2026-67575
GHSA-wcg9-8v95-6r4q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
PR:H is warranted because the attacker must hold a specifically delegated plugin management role; once that role is held, AC:L applies as no further conditions are needed, and full CIA impact follows from administrator escalation within the single WordPress instance.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated WordPress session for an account that has been explicitly granted the User Registration & Membership plugin's management capability - a role that is intentionally below full administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) correctly reflects that exploitation requires high privilege - specifically a delegated plugin management role - which materially limits the realistic attack population compared to a PR:N vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the User Registration & Membership WordPress plugin to version 5.2.6 or later, which introduces the missing capability check and is confirmed as the vendor-released patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using versions of this plugin prior to 5.2.6, and temporarily restrict delegated management capabilities on high-risk sites as interim protection. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated att
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-priv
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) expo
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.3.2.1. Rated high severity (CVSS 7.4), th
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
The User Registration - Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is
The User Registration & Membership - Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today