User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass

Description

The plugin does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.