Description

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T08:16:42.427Z",
  "pubdate": "2026-08-28T08:16:42.427Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin before version 5.2.6 contains a critical authorization flaw in its login settings configuration interface.\nThe vulnerability stems from a lack of proper capability checks during the save process for plugin-specific settings, resulting in an Insecure Direct Object Reference (IDOR) or Broken Access Control scenario.\nImpact includes the ability for authenticated users with limited plugin-management capabilities to modify arbitrary site options within the WordPress database. By overwriting key configuration settings—such as 'users_can_register' or 'default_role'—an attacker can facilitate privilege escalation, effectively gaining administrative access to the WordPress environment.\nThe vulnerability is exploitable by authenticated users who have been granted restricted management permissions by the plugin. There is no requirement for full administrative privileges, making this a significant risk for multi-user WordPress installations that delegate membership management to lower-privileged accounts.\nSuccessful exploitation allows for complete site compromise, as the ability to manipulate site-wide options can lead to arbitrary code execution, unauthorized data exfiltration, or total platform takeover.",
  "technicalDetails": "The root cause of this vulnerability is the absence of rigorous server-side capability validation within the administrative handling logic responsible for persisting login configuration settings in the User Registration & Membership plugin prior to version 5.2.6.\nIn WordPress development, administrative functions should utilize the current_user_can() function to verify that the requesting user possesses the necessary privileges (e.g., 'manage_options') before executing database write operations. In this instance, the plugin fails to implement this check, incorrectly assuming that a user possessing plugin-specific management capabilities is authorized to modify global WordPress site options.\nThe exploitation flow initiates when a user, authenticated with a limited plugin-management role, navigates to the affected settings interface. Because the backend processing logic fails to validate the user's authority against the requested configuration update, the plugin accepts arbitrary input through HTTP POST requests.\nAn attacker can intercept this request and inject malicious values into site options. For example, by modifying the 'wp_user_roles' option or setting 'users_can_register' to '1' combined with a custom 'default_role' set to 'administrator', the attacker can force the application to register new accounts with elevated privileges.\nSince these options are stored in the wp_options table, changes made via this vulnerability persist until manually reverted or corrected by an administrator. This persistence mechanism ensures the attacker maintains a foothold even if their initial session is terminated.\nThis vulnerability is restricted to authenticated users, meaning it cannot be triggered by unauthenticated remote attackers. However, because it targets the core configuration of the WordPress installation, the post-exploitation impact is catastrophic, often resulting in complete site takeover and the ability to execute arbitrary PHP code via plugins or themes management enabled by the escalation."
}