Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-11963 (CVSS 8.1): User Registration & Membership WP plugin <5.2.2 missing auth on membership-upgrade. Update if in use. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/oXRR2PvOXf
Post summary
The tweet alerts to a high‑severity auth bypass in the User Registration & Membership WP plugin (<5.2.2) and advises users to update to the latest version.
🚨*CVE* CVE-2026-11963 The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modif… https://www.cve.org/CVERecord?id=CVE-2026-11963 ----- Traducción: CVE-2026-11963 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-11963, detailing an authorization bypass in a WordPress plugin, but does not provide a PoC, exploit code, or evidence of active exploitation.
CVE-2026-11963 The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modif… https://www.cve.org/CVERecord?id=CVE-2026-11963
Post summary
The text announces CVE‑2026‑11963, a WordPress plugin vulnerability involving missing authorization on membership upgrades, without providing PoC, exploit, or remediation details.