CVE-2026-86406 User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...

CVE-2026-86406

The User Registration & Membership WordPress plugin (versions 4.4.6-5.2.7 ) contains a privilege escalation vulnerability. The plugin fails to verify the capability of users making membership purchases and does not validate the submitted payment methods or plans. This allows any authenticated use...

CVE-2026-86406: Improper Privilege Management

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...