Description

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-13T06:16:24.947Z",
  "pubdate": "2026-09-13T06:16:24.947Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin before version 5.2.8 contains a critical security vulnerability involving improper authorization and validation controls. The flaw allows authenticated users with Author-level permissions or higher to manipulate membership plan assignments.\nBy failing to restrict the creation and modification of membership plans and failing to validate the integrity of the membership plan assigned to a user account, the plugin permits privilege escalation. An attacker can craft a request to assign a membership plan associated with administrative capabilities to their own user account, thereby elevating their privilege level to Administrator.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the WordPress installation, as it grants unauthorized administrative access to authenticated, low-privileged users. Exploitation requires an active, authenticated session with at least Author-level access. No complex social engineering or external interaction is required, making this an internal privilege escalation threat.\nThe vulnerability highlights a failure in server-side validation regarding the assignment of roles tied to membership levels within the plugin architecture.",
  "technicalDetails": "The vulnerability resides in the backend logic of the User Registration & Membership plugin, specifically within the mechanisms responsible for membership plan management and user-profile synchronization. The root cause is twofold: an insecure implementation of authorization checks for membership plan authoring and a lack of server-side validation when a user associates a membership plan with their account profile.\nThe attack flow begins when an attacker, authenticated as an Author or higher, identifies the endpoints or REST API routes utilized for updating user membership information. The plugin fails to verify if the requesting user has the appropriate authority to assign specific membership levels or if the chosen membership level is intended for general user selection.\nStep-by-step exploitation involves the following sequence: 1. The attacker navigates to the membership configuration section of their user profile or utilizes the corresponding API endpoint to modify their membership status. 2. The attacker intercepts the request, typically via a proxy tool, to modify the 'membership_plan' parameter. 3. The attacker injects the identifier of a high-privileged membership plan, such as one associated with the 'Administrator' role. 4. Upon submitting the request, the server-side code fails to validate the assignment, processing the update and associating the elevated role with the attacker's WordPress user account.\nBecause the plugin does not enforce restrictive logic on which users can claim which roles through the membership system, the application effectively trusts user-supplied input to define the user's role mapping. This bypasses WordPress's standard capability checks, as the membership system performs an unsanctioned modification of the user's meta-data or role-assignment table.\nPost-exploitation impact is total system compromise. Once the account is upgraded to Administrator, the attacker gains full control over the WordPress installation, allowing for arbitrary plugin/theme installation, code execution through administrative features, data theft, and persistence through the creation of additional backdoored accounts."
}