Privilege Escalation in User Registration & Membership ≤ 5.2.7

Executive Summary

A privilege escalation vulnerability, tracked as CVE-2026-80071, has been disclosed in the User Registration & Membership WordPress plugin, affecting versions before 5.2.8. The plugin fails to properly restrict who may author a membership plan and does not validate the plan a user attaches to their own account — allowing an authenticated attacker with Author-level access or above to assign themselves an arbitrary role, including Administrator.

CVSS Score: 7.2 (High)

The flaw is classified under CWE-269 (Improper Privilege Management) combined with broken access-control checks: the plugin trusts client-supplied data about plan/role assignment without cross-referencing it against the requesting user's actual permissions.

Vulnerability Overview

Affected Versions

A fix is already available. Site operators should update immediately rather than waiting on a future release.

How It Works

The plugin allows users to associate their account with a membership plan, which in turn can be mapped by the site owner to a specific WordPress role. The vulnerable code path does not verify that the requesting user is actually authorized to author or attach a given plan — it accepts the plan/role linkage supplied in the request. An attacker with Author-level privileges (a role many sites hand out to contributors, guest writers, or community members) can manipulate this process to attach their account to a plan mapped to the Administrator role, bypassing WordPress's normal capability checks entirely.

This is closely related to a companion flaw in the same plugin, CVE-2026-86406, where the plugin fails to verify payment or purchase status before granting a plan's associated role — meaning even a low-privilege subscriber could be granted an administrator-mapped plan without paying for it.

Why This Matters

• Low bar to exploit — Author is a common, often loosely-granted role on membership and multi-author sites, not a privileged tier.
• Direct path to full site control — successful exploitation can hand the attacker Administrator access, enabling plugin installation, arbitrary PHP execution via theme/plugin editors, and full database access.
• Sites that use this plugin to gate paid content or member tiers are especially exposed, since privilege and payment plans are managed by the same trust boundary that this bug breaks.

Recommended Actions

1. Update immediately to User Registration & Membership 5.2.8 or later.
2. Audit existing user roles — check wp_usermeta/wp_capabilities for any Author-level (or lower) accounts that have unexpectedly gained Administrator or other elevated roles.
3. Review membership plan-to-role mappings and remove any unnecessary linkage of plans to highly privileged roles.
4. Check plugin and site activity logs for suspicious plan-assignment or role-change requests around the disclosure date.
5. Rotate credentials and re-audit installed plugins/themes for any site where an unauthorized Administrator account is found, since full compromise may already have occurred.
6. Restrict the Author role to only what it strictly needs via a capability-management plugin, as defense-in-depth against similar flaws.

References

• NVD — CVE-2026-80071
• OffSeq Threat Radar — CVE-2026-80071
• Wordfence/WPScan — User Registration & Membership Vulnerability Database

Related Reading

• Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1
• Privilege Escalation in Amelia WordPress Plugin