CVE-2026-11963

The User Registration & Membership WordPress plugin version before 5.2.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform adequate authorization checks during a membership-upgrade action, incorrectly using a caller-supplied identifier to determine the targ...