CVE-2026-79996 — User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been …
Published: 2026-08-28 · CVSS: 7.2 · CVSS 3.1
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7