Insufficient Authorization in User Registration & Membership Plugin by WordPress
CVE-2026-11963
What is CVE-2026-11963?
The User Registration & Membership plugin for WordPress prior to version 5.2.2 has an authorization flaw that allows authenticated users to change the roles and membership tiers of other users. This occurs because the plugin does not adequately verify the identity of the user making the upgrade request, allowing any logged-in user, such as a subscriber, to alter another user's account settings by supplying an identifier of their choice. This vulnerability poses a significant risk by enabling unauthorized modifications to user privileges.
Affected Version(s)
User Registration & Membership 0 < 5.2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.