What the vulnerability does
01Description
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
Explanation of Vulnerability in Simple Terms
02Summary
The User Registration & Membership plugin for WordPress contains a privilege management flaw that allows unauthenticated attackers to gain unauthorized access to sensitive functionality. An attacker can exploit this vulnerability over the network without user interaction to read, modify, or delete data, or disrupt site availability. All versions up to 5.1.2 are affected.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data; disrupt site availability; gain unauthorized administrative access.
Potential impact on your site
04Site Impact
Attackers can compromise user accounts, steal data, modify content, or take the site offline without any warning.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 3, 2026
CVE published
April 8, 2026
Record updated
