CVE-2026-11963 Overview
CVE-2026-11963 is a broken access control vulnerability in the User Registration & Membership WordPress plugin before version 5.2.2. The plugin's membership-upgrade action fails to perform an authorization check and derives the target user from a caller-supplied identifier rather than the authenticated session. Any authenticated user, including a low-privilege subscriber, can change another user's WordPress role and membership tier by submitting a crafted request. The flaw enables horizontal and vertical privilege escalation across the WordPress installation.
Critical Impact
Authenticated subscribers can elevate their own privileges or modify other accounts, including administrators, leading to full site compromise.
Affected Products
- User Registration & Membership WordPress plugin versions prior to 5.2.2
- WordPress sites with subscriber-level or higher self-registration enabled
- Any deployment exposing the vulnerable membership-upgrade endpoint
Discovery Timeline
- 2026-07-13 - CVE-2026-11963 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-11963
Vulnerability Analysis
The vulnerability resides in the membership-upgrade handler of the User Registration & Membership plugin. The handler accepts a user identifier from the request payload and applies role and membership tier changes to that identifier without validating whether the caller owns the target account or holds administrative privileges. WordPress capability checks such as current_user_can('edit_users') are absent from the code path. This combination of Broken Access Control [CWE-284] and Insecure Direct Object Reference [CWE-639] allows attackers to bypass the plugin's intended trust boundary.
Root Cause
The root cause is twofold. First, the endpoint trusts a caller-supplied user identifier rather than resolving the target from the authenticated session via get_current_user_id(). Second, no authorization check gates the privileged action. Together these defects convert a self-service upgrade feature into an arbitrary role assignment primitive available to any logged-in account.
Attack Vector
The attack requires network access and a low-privilege authenticated session, such as a self-registered subscriber account. The attacker sends a request to the membership-upgrade action with the victim's user ID and the desired role or tier values. The plugin executes the change, granting the attacker administrator capabilities or altering another account's role. See the WPScan Vulnerability Description for technical details.
Detection Methods for CVE-2026-11963
Indicators of Compromise
- Unexpected changes to wp_usermeta entries for wp_capabilities and membership tier fields
- WordPress audit log entries showing role promotions initiated by non-administrator accounts
- HTTP POST requests to the plugin's admin-ajax.php or REST endpoints referencing membership-upgrade actions with a user_id parameter that does not match the session user
- New administrator accounts created shortly after subscriber registrations
Detection Strategies
- Monitor WordPress database changes to the wp_users and wp_usermeta tables for role modifications outside administrative sessions
- Inspect web server access logs for repeated calls to the plugin's membership-upgrade endpoint from subscriber-level sessions
- Correlate authentication events with subsequent capability changes to identify horizontal privilege escalation patterns
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record all role and capability changes
- Forward web and application logs to a centralized analytics platform for anomaly detection
- Alert on any privilege elevation event where the acting principal lacks the edit_users capability
How to Mitigate CVE-2026-11963
Immediate Actions Required
- Update the User Registration & Membership plugin to version 5.2.2 or later on all WordPress instances
- Audit wp_users and wp_usermeta for unauthorized role or membership tier changes since the plugin was installed
- Reset credentials for any account whose role changed without administrative approval
- Review recently registered subscriber accounts and remove suspicious ones
Patch Information
The vendor addressed the issue in User Registration & Membership 5.2.2 by adding an authorization check and binding the upgrade action to the authenticated session user. Refer to the WPScan advisory for remediation details.
Workarounds
- Disable the User Registration & Membership plugin until the patched version is deployed
- Restrict self-registration to trusted email domains or disable open registration in Settings > General
- Deploy a web application firewall rule that blocks requests to the membership-upgrade endpoint containing a user_id parameter mismatched to the session
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
