CVE-2026-79996CWE-269privilege-escalation

CVE-2026-79996

High · published August 28, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-08-28T12:16Z
References (1)
https://wpscan.com/vulnerability/609bbb7c-c19a-4c72-8cef-95598a2cfc0d/ · [email protected]
EPSS history
Timeline
  • 28 AUG 06:00Z
    User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
    cvelistv5