CVE-2026-11961

User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.

We have discovered 6,753 live websites that are affected by CVE-2026-11961.

Run a Free Instant Scan



Affected Software

Product  User Registration
Category Wordpress Plugins
Vulnerable Domains6,753 live websites (94% of User Registration install base)
Vulnerable Versions
  • from 0 through 5.2.3
Vulnerable Versions Count141 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-269 Improper Privilege Management



Details

  • Published - Jul 17, 2026
  • Updated - Jul 17, 2026

Credits

  • Khaled Alenazi (Nxploited) (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-11961
United States1,910 websites


Italy525 websites
Germany509 websites
GB341 websites
France315 websites
Spain264 websites
Brazil169 websites
Canada160 websites
Cyprus159 websites
Australia155 websites

Website Distribution by TLD

Number of websites using CVE-2026-11961
.com2,728 websites
.org473 websites
.it405 websites
.de198 websites
.co.uk159 websites
.com.br154 websites
.net142 websites
.com.au139 websites
.nl127 websites
.fr111 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11961

Top websites that are affected by CVE-2026-11961. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****************.com France**,***
*********.com United States**,***
******.***.my Malaysia**,***
************.com United States**,***
*************.com United States**,***
********.de Germany**,***
************.**.il Israel**,***
*************.com United States**,***
***.**.th Thailand**,***
********.com United States***,***
See full domain list

FAQ

CVE-2026-11961 is Improper Privilege Management in User Registration
A total of 6,753 websites have been identified as vulnerable to CVE-2026-11961, based on global website indexing conducted by WebTechSurvey.
The User Registration is affected by the CVE-2026-11961 vulnerability.
User Registration versions up to 5.2.3 are vulnerable to CVE-2026-11961.
CVE-2026-11961 is resolved in version 5.2.3 of User Registration.