CVE-2026-11963
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.
Risk Assessment
The organization is at risk of unauthorized privilege escalation, where a regular user can assign themselves or others an administrator role, leading to full compromise of the WordPress site.
Recommendation
Immediately update the User Registration & Membership plugin to version 5.2.2 or later, which includes a fix for the authorization vulnerability.
Other vulnerabilities in User Registration & Membership
See all- CVE-2026-11964Critical
The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
- CVE-2026-11966Medium
The User Registration & Membership WordPress plugin before version 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
- CVE-2026-11961High
The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.
- CVE-2026-11965Medium
The User Registration & Membership WordPress plugin before version 5.2.0 does not enforce payment completion before activating a paid membership subscription. This allows unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
- CVE-2026-1865Medium
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 'membership_ids[]' parameter in all versions up to and including 5.1.2. Insufficient escaping and preparation on the SQL query allows authenticated attackers (Subscriber-level and above) to append additional SQL queries.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.