The User Registration & Membership plugin for WordPress permits authenticated users with Contributor-level permissions to misconfigure site-wide content restriction rules. The vulnerability arises from a missing capability check on the plugin’s REST API endpoints, where the check_permissions function only verifies the edit_posts capability instead of an administrator-level privilege. As a result, malicious contributors can list, create, modify, toggle, duplicate, and delete content restriction rules, exposing restricted material or denying legitimate users access. The weakness can lead to data exposure or denial of service for protected content.

WordPress sites running the User Registration & Membership plugin versions 5.0.1 through 5.1.4 are affected. The plugin, offered by WP Everest, provides free and paid memberships, subscriptions, content restriction, user profiles, and a custom user registration and login builder. All installations using these versions of the plugin are susceptible.

The CVSS score of 5.4 indicates moderate severity. Exploitation requires a valid user account with Contributor or higher privileges; no public exploit is listed in the CISA KEV catalog and EPSS data is unavailable. Because the attack vector is authenticated and dependent on the REST API, the likelihood of widespread exploitation is lower than for unauthenticated flaws, yet the impact on business processes—especially when content visibility is critical—requires prompt attention.