CVE-2026-80071 Overview
CVE-2026-80071 is a privilege escalation vulnerability in the User Registration & Membership WordPress plugin versions prior to 5.2.8. The plugin fails to restrict who may author a membership plan and does not validate the plan a user attaches to their own account. Authenticated users holding Author-level access or higher can assign themselves an arbitrary role and elevate their privileges to Administrator. The flaw is classified under [CWE-269] Improper Privilege Management.
Critical Impact
An authenticated Author-level user can escalate to full Administrator, gaining complete control of the WordPress site, its content, users, and installed plugins.
Affected Products
- User Registration & Membership WordPress plugin versions before 5.2.8
- WordPress installations exposing Author-level or higher registration
- Sites using the plugin's membership plan feature
Discovery Timeline
- 2026-09-13 - CVE-2026-80071 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80071
Vulnerability Analysis
The User Registration & Membership plugin exposes membership plan creation and assignment functionality without adequate authorization checks. Two related weaknesses combine to enable privilege escalation. First, the plugin allows users with the edit_posts capability, granted to the Author role, to author membership plans. Second, the plugin does not validate the plan a user attaches to their own account against a server-side allowlist.
Because membership plans map to WordPress roles, an attacker can craft or reference a plan that grants the administrator role. The plugin honors the attached plan when updating user metadata, promoting the account without an administrator review step. This trust boundary violation converts a low-value Author account into full site ownership.
Root Cause
The root cause is improper privilege management. The plugin conflates content-authoring capabilities with administrative membership configuration and omits a capability check comparing the requesting user's role against the target role granted by the plan.
Attack Vector
Exploitation requires an authenticated session with at least the Author role. The attacker interacts with the plugin's membership plan endpoints to either create a plan tied to the administrator role or select an existing plan whose role assignment is not filtered. After the plan is applied to the attacker's account, the account inherits the administrator role on the next authenticated request.
The vulnerability mechanism is documented in the WPScan Vulnerability Report. No verified public exploit code is available at this time.
Detection Methods for CVE-2026-80071
Indicators of Compromise
- Unexpected role changes on user accounts, especially accounts recently promoted from Author to Administrator.
- New membership plans in the plugin database that reference the administrator role.
- WordPress audit log entries showing set_role or update_user_meta operations initiated by non-administrator users.
- New administrator-level accounts created after a low-privileged user session.
Detection Strategies
- Query the wp_usermeta table for wp_capabilities changes correlated with recent plugin activity.
- Monitor plugin-specific AJAX and REST endpoints for requests originating from Author-level sessions.
- Compare current administrator counts against a known baseline and alert on additions.
Monitoring Recommendations
- Enable WordPress audit logging with a plugin that records role and capability changes.
- Forward web server access logs to a centralized log platform and alert on POST requests to membership plan endpoints from non-admin users.
- Review new plugin installations and theme edits performed by any account promoted within the last 30 days.
How to Mitigate CVE-2026-80071
Immediate Actions Required
- Update the User Registration & Membership plugin to version 5.2.8 or later on all WordPress instances.
- Audit all Administrator accounts and remove any that cannot be attributed to a known operator.
- Rotate credentials and invalidate active sessions for any account that showed role changes after the disclosure date.
- Review recently created membership plans and delete any that map users to privileged roles.
Patch Information
The vendor fixed the issue in version 5.2.8 of the User Registration & Membership plugin. Patch details are referenced in the WPScan Vulnerability Report. Administrators should verify the installed version through the WordPress Plugins dashboard after applying the update.
Workarounds
- Temporarily disable the User Registration & Membership plugin until the patched version is deployed.
- Restrict Author-level and higher accounts to trusted operators and remove unused elevated accounts.
- Place the WordPress admin area behind an IP allowlist or web application firewall rule to limit access to plugin endpoints.
- Enforce multi-factor authentication for all accounts with Author-level access or higher.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
