Vulnerability · Published Jul 17, 2026 · Assigned by WPScan

CVE-2026-11961User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

High 8.1

In plain English

A high-severity privilege mismanagement in User Registration & Membership from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.

Affected products (as reported)

Vendor	Product	Versions
Unknown	User Registration & Membership	0 – before 5.2.3

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/2ffab574-8626-472e-b6e4-09bcbaa62349/ exploit, vdb-entry, technical-description