CVE-2026-79996
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.
Risk Assessment
An attacker could gain full control of the WordPress site by changing critical settings and obtaining administrator privileges.
Recommendation
Update the User Registration & Membership plugin to version 5.2.6 or later, which includes the capability check fix.
Other vulnerabilities in User Registration & Membership WordPress plugin
See all- CVE-2026-79995Medium
The User Registration & Membership WordPress plugin before version 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request. Authenticated users with Subscriber-level access and above can cancel any other user's in-progress email change, including an administrator's.
- CVE-2026-16736High
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.