The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing… (CVE-2026-79996)

A vulnerability exists in the User Registration & Membership WordPress plugin prior to version 5.2.6 where the plugin does not verify user capabilities when saving login settings. This allows users who have been granted management capabilities specific to the plugin, but who are not full administrators, to change arbitrary site options. Consequently, these users can escalate their privileges to administrator level, potentially compromising the entire WordPress site.

Authenticated users with limited plugin management permissions can exploit this vulnerability to gain full administrator privileges. This privilege escalation can lead to complete site compromise, including unauthorized configuration changes, content manipulation, and potential further exploitation of the WordPress environment.

Upgrade the User Registration & Membership WordPress plugin to version 5.2.6 or later, where this capability check issue has been addressed. No other mitigation guidance is provided; patching is the recommended remediation.