CVE-2026-11963 is an authorization bypass vulnerability in the User Registration & Membership WordPress plugin prior to version 5.2.2. The plugin fails to verify that the user performing a membership-upgrade action is authorized to modify the targeted user account. Instead, it uses a user identifier supplied by the caller, enabling any authenticated user, including low-privileged roles such as subscribers, to escalate privileges by changing another user's role and membership tier.

An attacker with any authenticated account on the affected WordPress site can escalate their privileges by modifying other users' roles and membership tiers. This could lead to unauthorized access to restricted areas or administrative functions, potentially compromising the integrity and security of the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious membership upgrade activities. Avoid granting unnecessary authenticated access to untrusted users.