User Registration & Membership CVE-2026-86406

Exploitation requires a valid WordPress account with at minimum subscriber-level privileges - the attacker must be able to authenticate to the target site. On sites with open user registration (a near-universal configuration for membership sites using this plugin), this condition is trivially satisfied by self-registering a free account. The plugin must be running a version from 4.4.6 through pre-5.2.8. The degree of privilege escalation depends on how the site owner has configured plan-to-role mappings: if any plan is mapped to a privileged role (editor, author, or administrator), escalation to that role is possible; if all plans map exclusively to subscriber, the effective escalation is nil. Full administrator escalation - the worst-case outcome - requires the site owner to have mapped at least one membership plan to the administrator role. Exploitation is not possible by completely unauthenticated users, and it is not exploitable against sites where registration is closed or invite-only.

The NVD CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) reflects network-accessible exploitation requiring subscriber-level authentication and assigns AC:H, likely accounting for the dependency on administrator-configured plan-to-role mappings for maximum impact. In practice, the exploitation mechanics themselves are not complex - an authenticated user submits a crafted HTTP request with a target plan identifier, and the plugin assigns the associated role; AC:H may therefore be conservative, with the mapping dependency better classified as a deployment condition rather than attack complexity. A publicly available proof-of-concept from WPScan substantially lowers the barrier to exploitation; even a mid-sized municipal IT team in gliwice running a WordPress membership portal should treat this as an urgent patching priority rather than a deferred maintenance item. The vulnerability is not listed in CISA KEV at time of analysis, and EPSS data was not provided in the input. The primary exploitation limiter is the requirement for at least subscriber-level authentication, which prevents fully unauthenticated drive-by exploitation but is easily satisfied on any site that permits open self-registration - an extremely common pattern for membership sites built on this plugin category.

An attacker self-registers a free subscriber account on a WordPress membership site running the vulnerable plugin, then submits a crafted POST request to the membership purchase endpoint, specifying an administrator-mapped plan identifier and an arbitrary or omitted payment method parameter - bypassing the payment processor entirely. Because the plugin does not verify the subscriber's capability or validate the plan-payment relationship server-side, it immediately assigns the administrator role to the attacker's account. A public proof-of-concept from WPScan confirms this attack path is documented and reproducible with minimal technical skill.