The User Registration & Membership WordPress plugin is vulnerable to unauthorized privilege escalation, which could allow a standard subscriber to gain administrative access to the site.

The plugin fails to perform capability checks or validate payment methods during membership purchases, allowing any authenticated user to assign themselves roles mapped to paid plans. This improper privilege management (CWE-269) can lead to a full administrative compromise if the site owner has mapped paid plans to privileged roles.

Successful exploitation results in full administrative control over the WordPress instance, leading to total compromise of site integrity, data confidentiality, and system availability. Given the CVSS score of 7.5, this vulnerability represents a high risk, as it permits low-privileged users to bypass security controls and gain unauthorized elevated access to the web environment.

Immediate Action: Update the User Registration & Membership plugin to version 5.2.8 or later immediately to resolve the missing capability checks.

Proactive Monitoring: Review user account audit logs for any unexpected changes in user roles or suspicious membership activation events.

Compensating Controls: If immediate patching is not possible, temporarily disable the membership registration features or restrict account creation to prevent unauthorized exploitation of the checkout workflow.

Public Exploit Available: No

Organizations utilizing this plugin must prioritize the update to version 5.2.8 to prevent potential privilege escalation. Failure to remediate this vulnerability leaves the application susceptible to unauthorized administrative takeover, which could have severe consequences for site management and user data security.