Executive brief
The User Registration & Membership plugin for WordPress, which manages user accounts and subscription tiers, contains a security flaw in its membership upgrade process. An attacker with a basic user account can exploit this to change the membership level and system permissions of other users. In certain configurations, this could allow an attacker to grant themselves administrative control over the entire website.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'user_registration_membership_upgrade_membership' AJAX action. The plugin fails to validate that the 'current_subscription_id' provided in the request belongs to the authenticated user making the request. An attacker with Subscriber-level privileges can supply a victim's subscription ID to change that victim's WordPress role and membership tier. Furthermore, if an upgrade path is configured to a high-privilege role like Administrator, an attacker can use this flaw to escalate their own privileges. The issue is fixed in version 5.2.2.
Affected products
- Unknown User Registration & Membership < 5.2.2
Timeline
- 2026-06-15: disclosed
- 2026-06-22: advisory: WPScan advisory published
- 2026-07-13: patched: NVD publication date