Is CVE-2026-115600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115600 being exploited in the wild.

How severe is CVE-2026-115600?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Is there a fix for CVE-2026-115600?

Yes: fixed in 2.8.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115600 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115600?

Check whether you run DEV Institute Restrict User Access – Membership Plugin with Force at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115600: DEV Institute Restrict User Access , Membership Plugin broken access control

CVE-2026-115600 · Severity: medium · CVSS 5.3 · Published 2026-11-11

The Restrict User Access – Membership Plugin for WordPress is a plugin that controls which site pages and content are accessible to different user roles and membership levels. A broken access control vulnerability allows attackers to bypass these restrictions and access pages or perform actions they should not be permitted to do. This could result in unauthorized users viewing restricted content or taking privileged actions.

Technologies: DEV Institute Restrict User Access – Membership Plugin with Force. Vendors: DEV Institute.

Quick answers

Is CVE-2026-115600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115600 being exploited in the wild.
How severe is CVE-2026-115600?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: DEV Institute Restrict User Access – Membership Plugin with Force up to 2.8.3.
Is there a fix for CVE-2026-115600?: Yes: fixed in 2.8.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115600 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115600?: Check whether you run DEV Institute Restrict User Access – Membership Plugin with Force at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.8.4

Technical details

The plugin fails to properly validate user permissions when controlling access to restricted pages and functionality, allowing unauthenticated or unauthorized users to bypass access control checks. The vulnerability affects versions up to 2.8.3 and requires no authentication or user interaction to exploit. An attacker can access restricted content or execute actions they are not authorized to perform.

Affected products

DEV Institute Restrict User Access – Membership Plugin with Force up to 2.8.3

Timeline

2026-11-11: disclosed
2026-11-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.