User Registration & Membership EUVD-2026-76952

Exploitation requires an authenticated WordPress account with at least Author-level role on the target site; Subscriber and Contributor roles are not stated as sufficient based on the description. The User Registration & Membership plugin must be installed, activated, and running a version below 5.2.8. No non-default plugin configuration is required beyond standard activation. Exploitation is not possible without a valid Author-or-above account, limiting purely unauthenticated attack paths. Limiting factors include: (1) attacker must hold or obtain an Author-level or higher account, which is not granted by default to public registrants on most sites; (2) the plugin must be actively installed; (3) no exploitation is possible against sites where user registration is closed and no Author accounts exist for the attacker to compromise or register into.

The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2 by assigning PR:H. However, the description explicitly states exploitation requires only Author-level access, which in WordPress corresponds to PR:L - a low-privilege role regularly granted to content contributors and not requiring any administrative trust. This metric mismatch is a significant scoring error that understates real-world exploitability; correcting to PR:L raises the base score to approximately 8.8. A publicly available exploit exists per WPScan's advisory, meaning weaponization requires no novel research. EPSS data is not included in the supplied intelligence. No CISA KEV listing is present, so confirmed widespread active exploitation is not established. Despite the absence of KEV status, the combination of a low-privilege entry point, a trivial exploitation path (no race condition or chained vulnerability required), and a published exploit makes this a genuine priority for any WordPress site using this plugin with Author-level accounts.

An attacker registers or is granted an Author account on a WordPress site running User Registration & Membership before 5.2.8. Using the publicly available WPScan exploit, they submit a crafted membership plan creation or attachment request that specifies the Administrator role for their own account; the plugin applies the role without validating it against the submitter's current privilege level. The attacker's account is immediately elevated to Administrator, granting full control over the WordPress site including plugin management, user management, and hosting-level file operations through the theme/plugin editor.