CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
Authenticated users with limited plugin management capabilities can escalate privileges to administrator by modifying login settings without proper capability checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79996?
CVE-2026-79996 is a high-severity vulnerability in Unknown User Registration & Membership, published on 28 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
Weakness: CWE-269
Which versions are affected by CVE-2026-79996?
How do I fix CVE-2026-79996?
No fix has been published for CVE-2026-79996 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-79996 being exploited?
There is no known exploitation of CVE-2026-79996 in the wild and no public exploit code.
Sources
Also known as GHSA-wcg9-8v95-6r4q.