CVE-2026-11961: WordPress User Registration Auth Bypass

CVE-2026-11961 Overview

CVE-2026-11961 is a privilege escalation vulnerability in the User Registration & Membership WordPress plugin before version 5.2.3. The plugin fails to validate that the membership tier submitted during public registration belongs to the set of tiers allowed by the registration form. An unauthenticated attacker can tamper with the registration request and select any published membership tier, receiving that tier's associated user role. When an administrator-linked tier exists, the attacker gains administrative access to the WordPress site. The flaw is tracked under CWE-269: Improper Privilege Management.

Critical Impact
Unauthenticated attackers can register directly into any published membership tier, potentially obtaining administrator privileges on affected WordPress sites.

Affected Products

User Registration & Membership WordPress plugin versions prior to 5.2.3
WordPress sites using the plugin with public registration enabled
WordPress sites where a membership tier is linked to the administrator role

Discovery Timeline

2026-07-17 - CVE-2026-11961 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-11961

Vulnerability Analysis

The User Registration & Membership plugin exposes a public registration form that allows visitors to sign up and be assigned a membership tier. Each tier is associated with a WordPress user role. The registration handler accepts the tier identifier submitted by the client but does not enforce that the identifier matches one of the tiers configured for that specific registration form.

An attacker submits a modified registration request containing the identifier of any published membership tier on the site. The plugin assigns the corresponding role to the newly created account without further authorization checks. When a membership tier is linked to the administrator role, the attacker gains full control of the WordPress instance.

The vulnerability is a business logic flaw. The exploit path requires knowledge of a valid target tier identifier and a site configuration where a privileged tier is published. This condition is reflected in the attack complexity rating.

Root Cause

The root cause is missing server-side validation of user-supplied input against the authorized tier list configured for the registration form. The plugin trusts the tier identifier submitted by the client, violating the principle of complete mediation and enabling improper privilege management under [CWE-269].

Attack Vector

Exploitation occurs over the network against the plugin's public registration endpoint. The attacker intercepts or crafts the HTTP POST submitted during registration, replacing the tier value with an identifier corresponding to a higher-privileged tier. No authentication or user interaction is required. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-11961

Indicators of Compromise

New WordPress accounts created through public registration with elevated roles such as administrator, editor, or custom high-privilege membership roles.
Registration POST requests containing tier or membership identifiers that do not match the tiers displayed on the referenced registration form.
Unexpected role assignments in the wp_usermeta table shortly after account creation timestamps in wp_users.

Detection Strategies

Audit the WordPress user database for accounts created after the plugin was installed and correlate their role assignments with the registration form configuration.
Inspect web server logs for POST requests to registration endpoints containing tampered membership or tier parameters.
Compare tier identifiers in registration requests against the tier list authorized on each form and alert on mismatches.

Monitoring Recommendations

Enable WordPress audit logging for user creation and role change events.
Alert on any privilege escalation event where an account transitions to administrator outside of the normal admin workflow.
Monitor plugin version inventory to identify hosts still running User Registration & Membership below 5.2.3.

How to Mitigate CVE-2026-11961

Immediate Actions Required

Update the User Registration & Membership plugin to version 5.2.3 or later on all WordPress sites.
Review all existing WordPress accounts and remove or downgrade any unauthorized administrator or high-privilege users.
Rotate credentials and session tokens for administrator accounts if unauthorized users were identified.

Patch Information

The vendor addressed the flaw in User Registration & Membership version 5.2.3 by validating that the submitted membership tier belongs to the tiers permitted by the registration form before assigning the associated role. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable public registration in WordPress and in the plugin's settings until the patch is applied.
Unpublish any membership tier that grants administrator or other privileged roles, or unlink privileged roles from tiers exposed to public registration.
Restrict access to the registration endpoint using a web application firewall rule that blocks requests containing unexpected tier identifiers.

bash

# Configuration example: unpublish privileged tiers via WP-CLI until patched
wp plugin update user-registration --version=5.2.3
wp option get users_can_register
wp option update users_can_register 0