CVE-2026-4056: 
WordPress vulnerability analysis and mitigation

CVE-2026-4056 is a missing authorization vulnerability in the User Registration & Membership plugin for WordPress (by WPEverest), allowing authenticated attackers with Contributor-level access or above to manipulate site-wide content restriction rules. The flaw affects plugin versions 5.0.1 through 5.1.4 and was disclosed on March 24, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) in the Content Access Rules REST API endpoints of the plugin. Specifically, the check_permissions() method only verifies the edit_posts capability — a permission granted to Contributors and above — rather than requiring an administrator-level capability. This allows any authenticated user with at least Contributor access to send crafted REST API requests to list, create, modify, toggle, duplicate, or delete site-wide content restriction rules without proper authorization (Wordfence, WordPress Trac).

Successful exploitation can result in unauthorized exposure of restricted content (confidentiality impact) or denial of legitimate user access by deleting or modifying content restriction rules (integrity impact). An attacker with Contributor-level access could bypass paywalls or membership gates, expose premium or private content to unauthorized users, or disrupt site access controls for legitimate members. Availability is not directly impacted, but manipulation of access rules could effectively lock out legitimate users from protected content (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.02%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the User Registration & Membership plugin (versions 5.0.1–5.1.4) by inspecting HTTP response headers, page source, or using tools like WPScan.
2. Obtain Contributor access: Register or log in as a user with at least Contributor-level privileges on the target WordPress site.
3. Enumerate content restriction rules: Send an authenticated GET request to the plugin's Content Access Rules REST API endpoint (e.g., /wp-json/user-registration/v1/content-access-rules) to list existing rules.
4. Manipulate rules: Craft authenticated POST/PUT/DELETE REST API requests to create, modify, toggle, duplicate, or delete content restriction rules, bypassing the insufficient edit_posts capability check in check_permissions().
5. Achieve objective: Remove or disable restriction rules to expose premium/private content to unauthorized users, or delete rules to deny legitimate members access to protected content (Wordfence, WordPress Trac).

• Network: Unusual REST API requests to /wp-json/user-registration/v1/content-access-rules (or similar endpoints) from Contributor-level user accounts, especially POST, PUT, DELETE, or PATCH methods.
• Logs: WordPress access logs showing repeated REST API calls to content restriction endpoints from non-administrator accounts; unexpected changes to content restriction rules in the WordPress database (wp_options or plugin-specific tables).
• Application: Sudden disappearance or modification of content restriction rules in the plugin's admin dashboard; previously restricted content becoming publicly accessible without administrator action.

Site administrators should update the User Registration & Membership plugin to version 5.1.5 or later, which includes the fix restricting the check_permissions() method to require administrator-level capabilities (WordPress Trac Changeset). As an interim workaround, administrators can restrict Contributor-level user registration or temporarily disable the Content Restriction module until the plugin is updated. Regularly auditing content restriction rules for unauthorized changes is also recommended (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the week of March 23–29, 2026, and Sucuri included it in their March 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community reaction has been limited given the medium severity rating and the requirement for authenticated access.