CVE-2026-4056: Data Modification in WordPress User Registration

The core of the issue lies in a missing capability check within the Content Access Rules REST API endpoints. The checkpermissions() method incorrectly verifies only for editposts capability, rather than requiring administrator-level privileges. This oversight allows authenticated users with Contributor access or greater to perform actions such as listing, creating, modifying, toggling, duplicating, and deleting content restriction rules. An attacker could leverage this to expose content intended for specific user groups or administrators, or to completely block access to critical areas of the website. This could lead to data breaches, disruption of service, and potential reputational damage. The ease of exploitation, given the prevalence of WordPress and the common existence of users with Contributor roles, increases the potential for widespread compromise.

1. Reserved2026-03-12
2. Published2026-03-23
3. Modified2026-04-08
4. EPSS updated2026-03-31

The primary mitigation is to immediately upgrade the User Registration & Membership plugin to version 5.1.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the Content Access Rules REST API endpoints. This can be achieved through WordPress’s built-in role management features, ensuring that only administrators have the necessary permissions. Additionally, review existing content restriction rules for any anomalies or unauthorized modifications. For enhanced security, consider implementing a Web Application Firewall (WAF) with rules to block suspicious requests targeting these endpoints. Detection can be achieved by monitoring WordPress logs for unusual activity related to content restriction rule modifications by non-administrator users.

Active installs

60KKnown

Plugin rating