Vulnerabilities CVE-2026-11963

CVE-2026-11963

None

Open

TLP:CLEAR

User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.

Details

EPSS Score ⓘ: 0.20%

10.1th percentile
Confidence: 90%
Published: Jul 13, 2026
Last Modified: Jul 13, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.