The Membership Plugin – Restrict Content plugin for WordPress carries a privilege escalation vulnerability that exists in all releases up to version 3.2.20. The flaw is in the rcp_setup_registration_init() function, which accepts the rcp_level POST parameter without verifying that the membership level is active or that a payment is required. Because add_user_role() assigns the WordPress role configured for that level without any status checks, an unauthenticated attacker can register with any level, including inactive levels that grant privileged roles such as Administrator, or paid levels that would normally trigger a sign‑up fee. This allows creation of fully privileged user accounts without authentication or payment.

The affected product is the StellarWP Membership Plugin – Restrict Content. All releases up to and including version 3.2.20 are vulnerable; no other vendors or later versions are listed as affected.

The CVSS v3.1 base score for this issue is 8.1 (High), and the EPSS exploitation probability is reported as less than 1%, indicating a low overall likelihood at the present time. The vulnerability is not present in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated HTTP POST request to the plugin’s registration endpoint with any desired rcp_level value. Because the plugin does not validate the level against activation or payment status, the user is created and immediately granted the WordPress role associated with the supplied level. The partial patch introduced in version 3.2.18 does not fully mitigate the issue, and exploitation remains possible until a complete fix is applied in later releases.