The vulnerability originates in the user_registration_membership_register_member() function of the User Registration & Membership plugin, which accepts a membership_id parameter without validating ownership or authentication. This Insecure Direct Object Reference flaw allows an attacker to specify any membership ID and apply it to any user account, effectively granting or revoking paid or non‑active memberships without permission. The weakness is classified as CWE‑639 and results in unauthorized privilege changes that can alter user access levels across the site.

All installations of the wpeverest User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin, versions 4.1.3 and earlier. The plugin is available as a WordPress add‑on and can be installed on any WordPress site that uses this membership solution.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending an unauthenticated HTTP request to the plugin’s AJAX endpoint and supplying a selected membership_id value, thereby reassigning memberships for arbitrary users. No additional authentication or privileged access is required to trigger the change.