CVE-2026-86406

HighCVSS 7.5/10Last modified Sep 14, 2026

Description

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Unknown	User Registration & Membership	>= 4.4.6, < 5.2.8

References

https://wpscan.com/vulnerability/0fb4ec40-3f92-4c7e-8877-8898b355d78d/

Timeline

Published: Sep 13, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864073.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pa CVE-2026-864086.5Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()CVE-2026-864098.1Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran CVE-2026-864108.1A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an CVE-2026-864119.1An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-864128.1A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-864139.1When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its creden CVE-2026-864149.1An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-864157.5libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann CVE-2026-864165.4ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and CVE-2026-864174.3Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetc CVE-2026-864184.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restri