CVE-2026-11963

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin versions prior to 5.2.2

Description An issue exists where the plugin fails to perform an authorization check during a membership-upgrade action. The system identifies the user to be modified based on a caller-supplied identifier rather than the currently authenticated user. This allows any authenticated user, including those with subscriber-level privileges, to change the WordPress role and membership tier of other users.

Recommendations Update the User Registration & Membership WordPress plugin to version 5.2.2 or later.