CVE-2026-11961highCWE-269

CVE-2026-11961: falha de alta gravidade em User Registration & Membership

User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

Publicada em

Seguir esta CVE+ Monitorar User Registration & Membership

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.1epss 0.4%
da publicação à arma21 dias
Publicada no NVD17 de jul.
1ª PoC+21d
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · User Registration & Membership
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — User Registration & Membership

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2563HIGHUser Registration & Membership < 4.1.2- Unauthenticated Privilege EscalationEPSS 49.1%CVE-2025-2594HIGHUser Registration & Membership < 4.1.3 - Authentication BypassEPSS 9.5%CVE-2026-80071HIGHUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-79996HIGHUser Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login SettingsEPSS 0.5%CVE-2026-11964CRITICALUser Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership ActivationEPSS 0.5%CVE-2026-16736HIGHUser Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration DisabledEPSS 0.4%