The vulnerability resides in the User Registration & Membership WordPress plugin versions prior to 5.2.6. When an authenticated user, who has been granted the plugin’s management capability but not full administrator rights, saves the plugin’s login settings, the system bypasses a capability check. This oversight allows the user to modify any site option stored within WordPress, effectively granting them administrator privileges. The impact is a complete privilege escalation within the affected site, enabling the attacker to perform any action an administrator can, including adding or modifying users, changing site configuration, and installing additional plugins. The weakness is a classic missing authorization check, identified as CWE‑284.

The affected system is the WordPress plugin named User Registration & Membership. All installations running version 5.2.5 or earlier are vulnerable. No specific operating system or WordPress core version is indicated, but the vulnerability exists across all platforms where the plugin is active.

The CVSS score is not supplied in the data, so the specific severity rating cannot be confirmed. The EPSS score is unavailable, suggesting no current data on exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local to the WordPress site: an attacker must first authenticate as a user with the plugin management capability, then access the plugin’s settings interface. Once the setting is altered, administrative privileges are granted, resulting in full control over the site. The risk is high given the complete escalation to admin, but the exploitability depends on the attacker’s ability to obtain a user account with the requisite capability and access the plugin’s configuration page.