User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation

The core of the issue lies in a missing capability check within the Content Access Rules REST API endpoints. The checkpermissions() method incorrectly verifies only for editposts capability, rather than requiring administrator-level privileges. This oversight allows authenticated users with Contributor access or greater to perform actions such as listing, creating, modifying, toggling, duplicating, and deleting content restriction rules. An attacker could leverage this to expose content intended for specific user groups or administrators, or to completely block access to critical areas of the website. This could lead to data breaches, disruption of service, and potential reputational damage. The ease of exploitation, given the prevalence of WordPress and the common existence of users with Contributor roles, increases the potential for widespread compromise.

Websites utilizing the User Registration & Membership plugin, particularly those with a large number of users with Contributor or higher roles, are at risk. Shared hosting environments where users have more extensive permissions than typically granted are also particularly vulnerable. Sites relying on content restriction rules for sensitive data or restricted access areas face the highest risk.

• wordpress / plugin:

wp plugin list | grep 'User Registration & Membership'

• wordpress / plugin: Check plugin version. If < 5.1.5, the system is vulnerable.

wp plugin version user-registration-and-membership

• wordpress / plugin: Examine WordPress access logs for requests to /wp-json/user-registration/v1/rules originating from users with Contributor or lower roles. • wordpress / plugin: Review WordPress user roles and capabilities to ensure only administrators have access to manage content restriction rules.

1. 2026-03-23Disclosure

   disclosure

1. Reserviert2026-03-12
2. Veröffentlicht2026-03-23
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-31

The primary mitigation is to immediately upgrade the User Registration & Membership plugin to version 5.1.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the Content Access Rules REST API endpoints. This can be achieved through WordPress’s built-in role management features, ensuring that only administrators have the necessary permissions. Additionally, review existing content restriction rules for any anomalies or unauthorized modifications. For enhanced security, consider implementing a Web Application Firewall (WAF) with rules to block suspicious requests targeting these endpoints. Detection can be achieved by monitoring WordPress logs for unusual activity related to content restriction rule modifications by non-administrator users.

Aktive Installationen

60KBekannt

Plugin-Bewertung