CVE-2026-80071
Received Received - Intake

Privilege Escalation in User Registration & Membership WordPress Plugin

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: WPScan

Description
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-80071
EUVD
EUVD-2026-76952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpengine user_registration_and_membership to 5.2.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the WordPress plugin User Registration & Membership before version 5.2.8. It allows authenticated users with Author-level access or higher to assign themselves an arbitrary role, including Administrator, by exploiting improper restrictions on who can author membership plans.

Detection Guidance

Check the installed version of the User Registration & Membership plugin. If it is below 5.2.8, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep user_registration_and_membership in the WordPress directory.

Impact Analysis

If you use the affected plugin version, an attacker with Author-level access could escalate their privileges to Administrator. This could allow them to take full control of your WordPress site, modify content, install malicious plugins, or steal sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access and control of user data, violating GDPR and HIPAA compliance requirements for data protection and access controls. A successful exploit may result in data breaches or unauthorized modifications to sensitive information.

Mitigation Strategies

Update the User Registration & Membership plugin to version 5.2.8 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart