The User Registration & Membership plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its Content Access Rules REST API endpoints. The plugin's 'check_permissions()' method incorrectly checks only for the 'edit_posts' capability, which is insufficiently restrictive. Consequently, authenticated users with Contributor-level permissions or higher can perform unauthorized actions on content restriction rules, potentially compromising content access controls. This vulnerability affects versions 5.0.1 through 5.1.4 of the plugin. The CVSS v3.1 base score is 5.4, reflecting a medium severity impact with network attack vector, low attack complexity, and low privileges required.

Authenticated users with Contributor-level access or higher can exploit this vulnerability to list, create, modify, toggle, duplicate, and delete content restriction rules site-wide. This can result in unauthorized exposure of restricted content or denial of access to legitimate users. The vulnerability does not allow for denial of service or privilege escalation beyond the Contributor role, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for unusual activity related to content restriction rules. Avoid granting Contributor or higher privileges to untrusted users. Review and manually verify content restriction rules regularly to detect unauthorized changes.