CVE-2026-79996: CWE-269 Improper Privilege Management in User Registration & Membership

CVE-2026-79996 is an improper privilege management vulnerability (CWE-269) in the User Registration & Membership WordPress plugin versions prior to 5.2.6. Authenticated users who have been granted management capabilities specific to the plugin but do not have full administrator access can exploit this flaw to modify arbitrary site options. This capability bypass allows privilege escalation to administrator level, potentially compromising the entire WordPress site. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with authenticated access and limited management rights in the plugin can escalate privileges to administrator by changing arbitrary site options. This can lead to full site compromise, including control over content, user accounts, and site configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin management capabilities to trusted users only and monitor for suspicious privilege changes.