Executive brief
A vulnerability in the User Registration & Membership plugin for WordPress allows unauthorized individuals to grant themselves high-level access to a website. By manipulating the registration process, an attacker can sign up for a membership tier they are not supposed to access, potentially gaining full administrative control over the site. This could lead to complete site takeover, data theft, or the defacement of the web presence.
Technical details
The User Registration & Membership plugin for WordPress fails to validate the membership tier ID submitted during the public registration process. Specifically, the plugin does not verify if the requested tier is permitted by the specific registration form being used before assigning the associated WordPress user role. An unauthenticated attacker can exploit this by submitting a registration request with a membership tier ID linked to a high-privilege role, such as Administrator. If such a tier exists and is published, the attacker will be granted that role upon registration. This issue is fixed in version 5.2.3.
Affected products
- Unknown User Registration & Membership < 5.2.3
Timeline
- 2026-06-26: disclosed: Publicly published by WPScan
- 2026-07-17: advisory: CVE published to NVD dataset