User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder EUVD-2026-14656

This vulnerability presents a moderate real-world risk, supported by multiple corroborating signals. The CVSS 3.1 score of 5.4 reflects an attack vector of Network, low attack complexity, low privilege requirements, and scope unchanged with low confidentiality and integrity impact. The attack is readily automatable by any authenticated user without special conditions. The vulnerability affects a widely-used WordPress plugin with millions of installations, increasing the attack surface. While no public exploit code or proof-of-concept has been widely disclosed based on available references, the straightforward nature of the bypass (a simple capability check misconfiguration) and public availability of the vulnerable code in the WordPress plugin repository reduces the barrier to exploitation. The presence of Wordfence as a reporting source and the specific, detailed vulnerability description suggest this has been actively researched. However, the requirement for prior authentication (PR:L in CVSS) limits opportunistic exploitation and constrains the threat actor pool to users who have legitimate access to the WordPress installation at contributor level or above. Organizations with strict contributor access controls and regular plugin updates face lower risk than those with permissive user management practices.

An attacker with a legitimate contributor-level WordPress account (obtained through a standard user registration form or provided by the site administrator) authenticates to the WordPress installation and directly calls the Content Access Rules REST API endpoint via POST request to /wp-json/urcr/v1/content-access-rules/. Due to the insufficient capability check, the endpoint accepts the request and allows the attacker to create a new content access rule that removes restrictions from sensitive pages, or alternatively, adds restrictions to pages containing competitor information or critical site functionality. The attack requires only network access and authentication, no user interaction, and can be fully automated, allowing an attacker to systematically enumerate and modify all content restrictions across the site to achieve their objective of exposing restricted content or denying user access to legitimate site features.