CVE-2026-80071 in User Registration & Membership Plugin
Summary
by MITRE • 09/13/2026
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in versions of the User Registration & Membership plugin prior to 5.2.8 represents a critical failure in server-side authorization logic within the WordPress ecosystem. This flaw specifically targets the administrative functionality related to membership plan management, where the application fails to enforce proper access controls on endpoints responsible for creating or modifying membership configurations. The core technical deficiency lies in the absence of robust validation mechanisms that verify whether an authenticated user possesses the requisite privileges to perform specific actions regarding membership plans and role assignments. Instead of restricting these operations exclusively to users with Administrator-level permissions, the plugin allows any authenticated user holding Author-level access or higher to interact with sensitive configuration parameters without adequate verification of their authority level relative to the action being performed.
From a technical perspective, this vulnerability constitutes an Insecure Direct Object Reference combined with Broken Access Control issues as defined by industry standards such as CWE-269 and CWE-862. The attacker exploits the lack of server-side checks on the membership plan assignment process. By manipulating HTTP requests to include specific parameters that link their user account to a newly created or existing membership plan, an authenticated adversary can bypass standard WordPress role restrictions. This manipulation allows the user to arbitrarily assign themselves elevated privileges, effectively escalating their access from Author-level directly to Administrator status within the application environment. The flaw stems from trusting client-supplied data regarding role assignments without cross-referencing it against the current user's actual permission set in the database.
The operational impact of this vulnerability is severe due to its potential for complete system compromise. Once an attacker achieves Administrative privileges, they gain unrestricted access to all aspects of the WordPress installation. This includes the ability to install and activate malicious plugins, modify core theme files, alter database structures, and execute arbitrary code through various vectors available to administrators. The compromised account can be used to deface websites, inject malware into legitimate content, steal sensitive user data stored in the database, or use the server as a pivot point for further attacks against internal networks. Given that WordPress powers a significant portion of the web, this vulnerability poses a substantial risk to organizations relying on this platform for their digital presence and e-commerce operations.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running affected versions should upgrade the User Registration & Membership plugin to version 5.2.8 or later, where these authorization checks have been corrected. In scenarios where updating is not immediately feasible due to compatibility constraints with other plugins or custom code modifications, temporary workarounds may include restricting user registration capabilities entirely if they are not required for business operations. Additionally, implementing strict role-based access control policies and auditing plugin source code for similar patterns of insecure authorization can help prevent exploitation. Security monitoring should be enhanced to detect unusual privilege escalation activities or unexpected changes in user roles within the WordPress database tables.