The vulnerability resides in the User Registration & Membership WordPress plugin versions prior to 5.2.6. When an authenticated user, who has been granted the plugin’s management capability but not full administrator rights, saves the plugin’s login settings, the system bypasses a capability check, allowing the attacker to modify any site option stored within WordPress and effectively gaining administrator privileges. This oversight is an example of a missing authorization check, identified as CWE-269 (inferred). The impact is a complete privilege escalation within the affected site, enabling the attacker to perform any action an administrator can, including adding or modifying users, changing site configuration, and installing additional plugins.

The affected system is the WordPress plugin named User Registration & Membership. All installations running version 5.2.5 or earlier are vulnerable (inferred). No specific operating system or WordPress core version is indicated, but the vulnerability exists across all platforms where the plugin is active.

The CVSS score for this vulnerability is 7.2, indicating a high severity. The EPSS score is less than 1%, implying a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is local to the WordPress site: an authenticated user who has been granted the plugin’s management capability but not full administrator rights must first log in and then access the plugin’s login settings page. When the modified settings are saved, the absent capability check allows the attacker to change any WordPress option, effectively escalating their privileges to administrator (inferred). The risk is high given the complete escalation to admin, but the exploitability depends on the attacker’s ability to obtain a user account with the requisite capability and access the plugin’s configuration page.