CVE-2026-80071

תיאור (מקור, אנגלית)

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

מדדים

CVSS 3.1

7.2 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-3/10/2026

CWE

CWE-269

קישורים

• https://wpscan.com/vulnerability/a4fbdeea-0d3b-466b-b4b6-4c4db277cd1d/