Privilege Escalation Vulnerability in Membership Plugin for WordPress

CVE-2026-1321

What is CVE-2026-1321?

The Membership Plugin – Restrict Content for WordPress is susceptible to a privilege escalation vulnerability across all versions up to 3.2.20. This issue arises from the rcp_setup_registration_init() function, which allows any membership level ID to be accepted without proper validation of its activity status or necessity for payment. Attackers can exploit this flaw to create accounts with unauthorized membership levels, potentially gaining access to privileged roles such as Administrator. Although a partial patch was implemented in version 3.2.18, earlier versions remain vulnerable and expose sites to significant risks.

References