Description

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T06:16:25.157Z",
  "pubdate": "2026-09-13T06:16:25.157Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin before version 5.2.8 is vulnerable to a critical authorization bypass flaw. This vulnerability enables authenticated users, such as low-privileged subscribers, to assign themselves unauthorized WordPress roles associated with premium membership plans without completing a valid financial transaction.\nThe vulnerability stems from a lack of capability checks and input validation on the membership purchase mechanism. By manipulating the parameters submitted during the purchase process, an attacker can bypass payment verification and server-side validation of the selected plan. This allows the attacker to trigger the role-assignment logic normally reserved for successful premium plan activations.\nThe impact is severe; if a site administrator has configured paid plans that grant high-level privileges, an attacker can perform privilege escalation to gain administrative access. This grants the attacker full control over the affected WordPress installation, leading to potential data breaches, site defacement, or total system compromise. The vulnerability is exploitable by any authenticated user, requiring no specific administrative permissions or interaction from other users, making it a high-risk security issue for installations utilizing the plugin's membership features.",
  "technicalDetails": "The vulnerability originates from insecure implementation of the plugin's purchase processing logic, specifically within the endpoint responsible for membership plan enrollment. The root cause is twofold: the absence of rigorous capability checks on the requesting user and the failure to perform server-side validation of the payment method and the associated plan submission.\nWhen a user initiates a membership purchase, the plugin processes the request to grant the user the WordPress role mapped to the chosen plan. Because the application logic fails to verify if the requesting user possesses the necessary privileges to modify their own role, or if the transaction was indeed authorized by a payment gateway, it creates an insecure state. The plugin implicitly trusts the data provided in the HTTP request regarding the selected plan and the payment status.\nThe exploitation flow proceeds as follows: First, an authenticated user (such as a 'Subscriber') observes the network requests generated during a standard membership purchase process. By intercepting these requests, the attacker can identify the parameters responsible for defining the target plan ID and the payment confirmation. The attacker then crafts a malicious request by modifying these parameters to point to a restricted or high-privilege plan. Since the plugin fails to perform server-side validation of the payment method against the plan requirements, the application proceeds to execute the post-purchase role-assignment function.\nThe vulnerable component is the processing routine that handles user role updates upon purchase completion. This routine fails to validate the integrity of the transaction, effectively treating the request as a legitimate, paid operation. Consequently, the plugin updates the user's meta information and WordPress role in the database to match the unauthorized plan. If a site owner has mapped a high-privilege role (such as 'Administrator') to a premium membership plan, the attacker successfully performs horizontal and vertical privilege escalation. The scope of the attack is limited only by the roles defined in the WordPress environment. Post-exploitation, the attacker gains full control over the administrative interface, allowing for the execution of arbitrary code, modification of site content, and potential persistent backdooring of the environment. The issue is persistent until the user record is manually modified by an administrator, providing the attacker with sustained unauthorized access."
}