CVE-2026-12497

Name of the Vulnerable Software and Affected Versions Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content versions prior to 4.16.18

Description An issue exists where the plugin does not consistently enforce role restrictions on the front-end registration role-selection field. This occurs because the roles offered to the visitor and the roles accepted by the registration handler are processed by two different parsers. In certain configurations, the handler ignores restrictions and accepts any non-administrator role. Due to the absence of a nonce (a unique token used to prevent replay attacks) on the public registration handler, an unauthenticated visitor can register an account with a higher role, such as Editor or Author, than intended by the configuration.

Recommendations Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to version 4.16.18 or later.