The User Registration & Membership plugin for WordPress, versions up to 4.1.3, contains an authorization bypass vulnerability (CWE-639) due to lack of validation on a user-controlled 'membership_id' key in the user_registration_membership_register_member() function. This allows unauthenticated attackers to update any user's membership to arbitrary membership types, including active or inactive ones. The vulnerability is classified as an insecure direct object reference (IDOR). It has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability. There is no patch or official fix currently documented.

An unauthenticated attacker can modify membership assignments of any user, potentially escalating or altering membership privileges without authorization. This impacts the integrity of membership data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality where possible and monitor for updates from the vendor. Avoid exposing membership management endpoints to unauthenticated users.