User Registration & Membership CVE-2026-79996

Exploitation requires an active, authenticated WordPress session for an account that has been explicitly granted the User Registration & Membership plugin's management capability - a role that is intentionally below full administrator. This is not a default WordPress role; an administrator must have deliberately delegated this capability to a lower-privileged user. Sites where no such delegation has occurred are not at risk from this specific path. Limiting factors: the attacker cannot be anonymous (PR:H per CVSS), cannot exploit via a direct unauthenticated request, and the vulnerable condition only exists on WordPress installations running plugin versions below 5.2.6 with at least one non-admin user holding the plugin management role. There is no user interaction required from a victim once the attacker's session is established.

The CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) correctly reflects that exploitation requires high privilege - specifically a delegated plugin management role - which materially limits the realistic attack population compared to a PR:N vulnerability. EPSS data was not supplied, so exploitation probability cannot be quantified from that signal. SSVC rates exploitation as 'none' and automatable as 'no', aligning with the PR:H gate; however, SSVC also rates Technical Impact as 'total,' confirming that a successful exploit results in complete site compromise. A public POC is available (WPScan), which lowers the skill bar for any attacker who already satisfies the privilege prerequisite. The practical risk is highest in multi-tenant WordPress environments or managed hosting scenarios where plugin management roles are delegated to clients or contributors - even a mid-sized IT operation in legnica running a multi-author WordPress deployment would face meaningful risk if plugin roles have been granted to partially-trusted accounts. CVSS and SSVC signals are consistent and non-conflicting; no KEV listing means widespread opportunistic exploitation has not been confirmed.

An attacker who holds, or has compromised, an account with the User Registration & Membership plugin management capability sends a crafted HTTP POST to the plugin's login settings save endpoint without triggering a capability check. By injecting a malicious value into wp_options - such as modifying role capabilities or the admin email - the attacker grants their own account full administrator privileges. A public POC is available via WPScan, meaning the specific request structure is documented.