WordPress Membership Plugin Privilege Escalation via Unauthenticated Role Assignment

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The User Registration & Membership WordPress plugin before version 5.2.8 contains a critical privilege escalation vulnerability (CVE-2026-86406, CVSS 7.5) that allows any authenticated subscriber to obtain administrator access without payment. The flaw stems from missing capability checks during membership plan purchases and inadequate validation of payment methods and plan submissions. This impacts any WordPress site using the vulnerable plugin with paid membership tiers mapped to privileged roles—particularly dangerous when premium plans grant administrative capabilities. An attacker with basic subscriber access can bypass the payment gateway entirely, directly claiming high-privilege roles and gaining full site control.

Casky.ai's 224 mapped security skills detect this attack pattern through MITRE ATT&CK technique TA0004 (Privilege Escalation) analysis, leveraging Claude AI's extended reasoning to identify capability validation failures and authorization bypass indicators. Practitioners using Casky would observe findings highlighting: (1) missing authorization checks on role assignment functions, (2) payment validation gaps where plan upgrades lack cryptographic or transactional verification, (3) insufficient input sanitization on membership parameters, and (4) direct role assignment occurring without proper capability verification via WordPress's `current_user_can()` functions. The platform's skill mapping would correlate these technical markers with CWE-269 (Improper Access Control) patterns, enabling security teams to rapidly identify vulnerable plugin instances and prioritize remediation before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86406.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-86406

Casky has 224 skills that investigate the attack patterns behind CVE-2026-86406. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn