PT-2026-57631 · WordPress · User Registration & Membership

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-11963

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 5.2.2

Description An issue exists where the plugin fails to perform an authorization check during a membership-upgrade action. The system identifies the user to be modified based on a caller-supplied identifier rather than the currently authenticated user. This allows any authenticated user, including those with subscriber-level privileges, to change the WordPress role and membership tier of other users.

Recommendations Update the User Registration & Membership WordPress plugin to version 5.2.2 or later.

Exploit

Related Identifiers

CVE-2026-11963

Affected Products

User Registration & Membership

References · 4

• 🔥 https://wpscan.com/vulnerability/a34a916a-983e-48a5-8f10-99214ee3b613 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11963 · Security Note
• https://twitter.com/infoflowcloud/status/2076614209622749328 · Twitter Post
• https://twitter.com/CVEnew/status/2076612863700168765 · Twitter Post