Missing Authorization Vulnerability in DEV Institute Restrict User Access Plugin
CVE-2026-115600

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Restrict User Access – Membership Plugin With Force
Vendor
CVE Published:
11 November 2026

What is CVE-2026-115600?

The DEV Institute's Restrict User Access – Membership Plugin with Force is susceptible to a missing authorization vulnerability that arises from improperly configured access control security levels. This issue can allow unauthorized users to exploit these configurations, potentially gaining access to restricted membership content. Available versions from n/a up to 2.8.3 are affected, emphasizing the need for prompt updates and security measures to mitigate risks.

Affected Version(s)

Restrict User Access – Membership Plugin with Force 0 <= 2.8.3

References

https://patchstack.com/database/wordpress/plugin/restrict...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ssophiz | Patchstack Bug Bounty Program
.