WordPress Plugin Allows Unauthorized Role Elevation

The User Registration & Membership WordPress plugin before version 5.2.2 contains a critical authorization bypass vulnerability that allows any authenticated user—including low-privileged subscribers—to escalate the roles and membership tiers of other users. The flaw stems from two compounding issues: the membership-upgrade action lacks proper authorization checks, and the plugin derives the target user from caller-supplied input rather than validating against the current authenticated user's identity. This means an attacker with basic subscriber access can modify administrators, editors, or other users' roles, potentially gaining administrative control over WordPress installations. Organizations using this plugin are at immediate risk of privilege escalation attacks that could lead to complete site compromise.

While this CVE does not currently map to MITRE ATT&CK techniques or have matching Casky skills, the underlying attack pattern aligns with privilege escalation and lateral movement tactics. Practitioners using Casky would typically identify similar vulnerabilities through skills that detect: insufficient access control validation on sensitive actions, parameter tampering on user-modification endpoints, and authentication/authorization bypass patterns. During incident investigation, security teams would look for POST requests to membership upgrade endpoints that reference user IDs other than the requester, unusual role change events in WordPress audit logs, and sudden administrator account creations by low-privileged users. Organizations should prioritize patching to version 5.2.2 or later, audit recent user role modifications, and implement stricter authorization controls at both the application and WAF levels to prevent unauthorized privilege escalation attempts.