A flaw in the User Registration & Membership plugin allows an unauthenticated user to submit a membership tier that is not part of the public registration form. The plugin assigns the requested tier’s user role without validation, enabling an attacker to create an account with any role, including administrator. This is a classic privilege‑escalation weakness (CWE‑269) that compromises the confidentiality, integrity, and availability of the site.

WordPress sites that use the User Registration & Membership plugin version earlier than 5.2.3. No specific vendor is identified, but any site running the affected plugin can be compromised.

The vulnerability has a CVSS score of 8.1, indicating high severity, while the EPSS score being less than 1 % suggests a low probability of exploitation in the short term. It is not listed in CISA’s KEV catalog. Likely attack vectors involve unauthenticated HTTP requests to the public registration endpoint, where an attacker can supply an arbitrary tier ID and receive the associated user role, without needing any prior privileges or special network conditions.