WordPress Plugin Privilege Escalation via Missing Capability Checks

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-79996 is a privilege escalation vulnerability in the User Registration & Membership WordPress plugin that allows authenticated users with limited plugin management capabilities to escalate to full administrator access. The flaw stems from missing capability checks when saving login settings, enabling attackers to modify arbitrary site options without proper authorization. This affects organizations using this plugin with role-based access control, where delegated administrators or plugin managers could abuse these permissions to gain complete site control—a critical threat when users are intentionally granted scoped responsibilities.

Casky's 224 matched security skills detect this attack pattern by mapping to MITRE ATT&CK technique TA0004 (Privilege Escalation) and identifying the underlying CWE-269 (Improper Access Control) weakness. Practitioners using Casky would observe detection findings highlighting unauthorized capability checks, unexpected site option modifications, and role elevation attempts from accounts that should have restricted permissions. Claude's extended reasoning enables the platform to correlate suspicious authentication logs with capability checks and configuration changes, surfacing the characteristic signature of this vulnerability: low-privileged authenticated accounts performing high-privileged actions without proper authorization gates. Security teams receive contextual intelligence linking the attack to the missing security control, accelerating both detection and remediation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-79996.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-79996

Casky has 224 skills that investigate the attack patterns behind CVE-2026-79996. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn