WordPress Plugin Fails to Validate Membership Tier Assignment

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The User Registration & Membership WordPress plugin before version 5.2.3 contains a critical privilege escalation vulnerability where membership tier validation is bypassed during public user registration. An unauthenticated attacker can register an account and arbitrarily assign themselves any published membership tier—including administrator-level roles—without the plugin verifying that the tier is permitted by the registration form's configuration. This affects any WordPress site running the vulnerable plugin with public registration enabled, potentially allowing complete site takeover when administrator tiers are exploitable. The CVSS 8.1 score reflects the ease of exploitation and severity of impact from unauthorized privilege escalation.

Casky's 224 matched skills leverage Claude's extended reasoning to detect the attack patterns behind CWE-269 (Improper Access Control) and MITRE technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detection of suspicious registration requests that submit unexpected or high-privilege membership tier parameters, coupled with abnormal role assignments granted to new users immediately after registration. The platform maps this to improper input validation patterns and insufficient authorization checks—specifically identifying where membership tier values are accepted without server-side allowlist verification against the form configuration. Findings would flag the absence of role-tier mapping validation, highlighting that attackers can POST arbitrary tier IDs during registration to claim elevated permissions, enabling lateral analysis of similar privilege escalation patterns across the threat landscape.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11961.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-11961

Casky has 224 skills that investigate the attack patterns behind CVE-2026-11961. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn