The vulnerability is a missing authorization check (CWE-862) in the embed_form_action() function of the User Registration & Membership plugin. Authenticated users with Contributor privileges or higher can add shortcode content to any page they cannot normally edit, enabling unauthorized content modification. This compromises site integrity, allowing attackers to deface or inject malicious content onto pages they do not own.

The vulnerability affects the WordPress User Registration & Membership plugin developed by WpEverest. All releases up to and including version 5.1.4 are impacted. The plugin operates within the WordPress content management system, allowing Contributors and roles with equivalent privileges to exploit the flaw.

The CVSS base score of 4.3 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with a Contributor role or higher and uses the plugin’s embed_form_action() endpoint to append shortcodes to any page, thereby bypassing normal WordPress permission checks. The missing capability check makes the attack trivial for any user with sufficient role membership.