Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the `check_permissions()` method only checking for `edit_posts` capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-24 | 1 | Disclosure1 |
| 2026-03-25 | 1 | General1 |
⚡ New CVE Alert: CVE-2026-4056 📊 Severity: 5.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4056 #CVE-2026-4056 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/1canGOcdgv
Post summary
The tweet simply announces CVE-2026-4056 with a medium severity rating for WordPress, including a reference to NIST but no further technical or exploit details.
CVE-2026-4056 The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules… https://www.cve.org/CVERecord?id=CVE-2026-4056
Post summary
The CVE-2026-4056 disclosure highlights a missing capability check in the WordPress User Registration & Membership plugin, allowing unauthorized data modification, with no patch or exploit details provided.