CVE-2026-12497 describes an improper privilege management vulnerability (CWE-269) in the Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin versions prior to 4.16.18. The plugin's front-end registration role-selection field uses two different parsers to determine which roles are offered to visitors and which roles the registration handler accepts. In some configurations, the registration handler ignores the configured role restrictions and defaults to accepting any non-administrator role. Additionally, the lack of a nonce on the public registration handler allows unauthenticated users to exploit this inconsistency to register accounts with elevated roles beyond those intended by the site administrator.

An unauthenticated attacker can register an account with elevated privileges such as Editor or Author, bypassing the intended role restrictions configured on the registration form. This could lead to unauthorized access to content management and other privileged actions within the WordPress site. The vulnerability does not allow administrator role assignment but still poses a significant risk of privilege escalation for unauthenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling front-end role selection on registration forms or restricting registrations to trusted users only. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.