CVE-2026-4056: WordPress User Registration Auth Bypass

CVE-2026-4056 Overview

The User Registration & Membership plugin for WordPress contains a broken access control vulnerability in versions 5.0.1 through 5.1.4. The vulnerability exists due to a missing capability check on the Content Access Rules REST API endpoints, where the check_permissions() method only validates for edit_posts capability instead of an administrator-level capability. This authorization bypass allows authenticated attackers with Contributor-level access or above to manipulate site-wide content restriction rules.

Critical Impact

Authenticated attackers with low-privilege Contributor accounts can list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access to protected resources.

Affected Products

• User Registration & Membership Plugin for WordPress versions 5.0.1 through 5.1.4
• WordPress sites using the Content Access Rules functionality
• Sites with contributor or higher-level user accounts enabled

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-4056 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-4056

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control flaw (CWE-862: Missing Authorization) in the WordPress plugin ecosystem. The core issue lies within the REST API endpoint handler for Content Access Rules, specifically in the permission validation logic.

The check_permissions() method in the class-urcr-content-access-rules.php file performs an inadequate capability check. Rather than verifying that the requesting user has administrator-level privileges required for managing site-wide content restrictions, the function only checks for the edit_posts capability—a permission granted to Contributors and above.

This architectural oversight means that any authenticated user with Contributor access can invoke the full range of Content Access Rules API operations, including listing all existing rules, creating new restriction policies, modifying or deleting existing rules, toggling rule states, and duplicating configurations.

Root Cause

The root cause is insufficient authorization validation in the REST API permission check. The check_permissions() method uses edit_posts capability check instead of manage_options or a custom administrator-level capability. WordPress Contributors possess edit_posts permissions by default, creating an unintended privilege escalation vector for content restriction management functions that should be reserved for administrators.

Attack Vector

The attack is network-based and requires low-privilege authentication. An attacker needs only a Contributor-level WordPress account to exploit this vulnerability. Once authenticated, the attacker can directly interact with the Content Access Rules REST API endpoints without additional user interaction.

The exploitation flow involves the attacker authenticating to the WordPress site with Contributor credentials, then making REST API requests to the Content Access Rules endpoints. The vulnerable check_permissions() method validates the edit_posts capability, which the attacker possesses, and the API processes the request, allowing unauthorized modifications to content restriction rules.

Technical details regarding the vulnerable code can be found in the WordPress Plugin Repository Source File.

Detection Methods for CVE-2026-4056

Indicators of Compromise

• Unexpected changes to content access rules not made by administrators
• REST API requests to /wp-json/user-registration/v1/content-access-rules endpoints from non-admin users
• Audit log entries showing content restriction modifications by Contributor-level accounts
• Reports from users about unexpected access to previously restricted content

Detection Strategies

• Monitor WordPress REST API access logs for requests to content-access-rules endpoints from non-administrator accounts
• Implement User Activity Logging plugins to track permission-sensitive operations
• Review access control rule changes for unauthorized modifications in the plugin settings
• Configure Web Application Firewalls to alert on unusual REST API activity patterns

Monitoring Recommendations

• Enable detailed logging on the WordPress REST API layer to capture authentication context
• Set up alerts for any content access rule modifications outside of normal administrative workflows
• Regularly audit user accounts with Contributor or higher roles for unauthorized activity
• Monitor for bulk or automated requests to the affected API endpoints

How to Mitigate CVE-2026-4056

Immediate Actions Required

• Update the User Registration & Membership plugin to a version higher than 5.1.4
• Audit all existing Content Access Rules for unauthorized modifications
• Review user accounts with Contributor-level access or above for suspicious activity
• Temporarily disable the Content Access Rules feature if an immediate update is not possible

Patch Information

The vulnerability has been addressed in versions newer than 5.1.4. The fix involves updating the capability check in the check_permissions() method to require administrator-level privileges. Details of the patch can be reviewed in the WordPress Changeset Update. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Demote unnecessary Contributor accounts to Subscriber level until patching is complete
• Implement additional REST API authentication controls through a security plugin
• Use a Web Application Firewall to restrict access to the vulnerable REST API endpoints
• Disable the Content Restriction module in plugin settings if not actively required

# Verify current plugin version and check for updates
wp plugin list --name=user-registration --fields=name,status,version
wp plugin update user-registration