User Registration & Membership lets authors assign themselves administrator
User Registration & Membership versions before 5.2.8 do not properly restrict membership-plan authorship or validate the plan an account attaches to itself. An authenticated Author-level user or above can select a plan carrying an arbitrary WordPress role and assign that role to their own account, escalating to Administrator. The authoritative export does not identify the plan handler, action, or plan and role parameters.
- Component
- User Registration & Membership
- Plugin slug
user-registration- Affected
- < 5.2.8
- Safe version
5.2.8- Published
- Sep 13, 2026
This CVE was published Sep 13, 2026 and is one of 49 known issues for this plugin.
Update, patch or deactivate.
Update User Registration & Membership to 5.2.8 or later. The application-level fix must restrict plan creation and role mapping to an appropriate administrative capability, prevent users from attaching unauthorized plans to themselves, and validate every resulting role assignment server-side.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H