This vulnerability is a missing authorization flaw that allows attackers to bypass intended access restrictions in the Restrict User Access – Membership Plugin with Force. Because the plugin fails to enforce proper access checks, privileged functions can be invoked by unauthenticated or lower‑privileged users, potentially granting them unauthorized rights to manage membership settings or access protected content. The vulnerability directly impacts the confidentiality, integrity, and availability of the WordPress site as privileged actions are exposed to users who should not have them.

The issue affects the DEV Institute Restrict User Access – Membership Plugin with Force for all released versions up to and including 2.8.1. Any WordPress installation that has this plugin installed and has not yet updated to a later release is potentially compromised.

The CVSS score of 5.3 indicates a moderate severity; the vulnerability is not listed in CISA KEV and no EPSS score is available, suggesting that exploitation is not widely documented. Exposing administrative or membership functions without proper authorization creates a moderate but non‑critical risk. Attackers would likely need authenticated access to the WordPress admin area or the ability to craft specially crafted requests against the plugin’s endpoints; therefore, the attack vector is inferred to be local to the WordPress environment rather than from an external network.