Improper Role Restriction in Paid Membership Plugin for WordPress
CVE-2026-12497
What is CVE-2026-12497?
The Paid Membership Plugin for WordPress prior to version 4.16.18 fails to consistently enforce role restrictions in its front-end registration process. This vulnerability arises because the role options presented to users and the roles accepted by the registration handler are evaluated by different parsers. As a result, specific configurations that are intended to restrict user roles may be ignored, permitting unauthorized users to register with elevated privileges, such as Editor or Author. The issue is exacerbated by the lack of a nonce in the public registration handler, further increasing the risk of unauthorized access.
Affected Version(s)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content 0 < 4.16.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.