CVE-2026-1321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1321", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-22T01:21:39.470Z", "datePublished": "2026-03-05T07:30:55.675Z", "dateUpdated": "2026-04-08T17:14:45.884Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:45.884Z"}, "affected": [{"vendor": "stellarwp", "product": "Membership Plugin \u2013 Restrict Content", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Membership Plugin \u2013 Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due to the `rcp_setup_registration_init()` function accepting any membership level ID via the `rcp_level` POST parameter without validating that the level is active or that payment is required. Combined with the `add_user_role()` method which assigns the WordPress role configured on the membership level without status checks, this makes it possible for unauthenticated attackers to register with any membership level, including inactive levels that grant privileged WordPress roles such as Administrator, or paid levels that charge a sign-up fee. The vulnerability was partially patched in version 3.2.18."}], "title": "Membership Plugin \u2013 Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abfaa4a6-92b0-4233-b08d-e668090d3fc2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1191"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1203"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/class-rcp-registration.php#L107"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/memberships/class-rcp-membership.php#L1939"}, {"url": "https://plugins.trac.wordpress.org/changeset/3447187/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3460177/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2026-01-22T01:37:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-04T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T14:54:54.966669Z", "id": "CVE-2026-1321", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T14:55:02.301Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-05T14:54:54.966669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T14:54:58.130Z"}}], "cna": {"title": "Membership Plugin \u2013 Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "stellarwp", "product": "Membership Plugin \u2013 Restrict Content", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.20"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-22T01:37:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-04T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abfaa4a6-92b0-4233-b08d-e668090d3fc2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1191"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1203"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/class-rcp-registration.php#L107"}, {"url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/memberships/class-rcp-membership.php#L1939"}, {"url": "https://plugins.trac.wordpress.org/changeset/3447187/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3460177/"}], "descriptions": [{"lang": "en", "value": "The Membership Plugin \u2013 Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due to the `rcp_setup_registration_init()` function accepting any membership level ID via the `rcp_level` POST parameter without validating that the level is active or that payment is required. Combined with the `add_user_role()` method which assigns the WordPress role configured on the membership level without status checks, this makes it possible for unauthenticated attackers to register with any membership level, including inactive levels that grant privileged WordPress roles such as Administrator, or paid levels that charge a sign-up fee. The vulnerability was partially patched in version 3.2.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:45.884Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1321", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:45.884Z", "dateReserved": "2026-01-22T01:21:39.470Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-05T07:30:55.675Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Membership Plugin \u2013 Restrict Content", "vendor": "stellarwp", "versions": [{"lessThanOrEqual": "3.2.20", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Membership Plugin \u2013 Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due to the `rcp_setup_registration_init()` function accepting any membership level ID via the `rcp_level` POST parameter without validating that the level is active or that payment is required. Combined with the `add_user_role()` method which assigns the WordPress role configured on the membership level without status checks, this makes it possible for unauthenticated attackers to register with any membership level, including inactive levels that grant privileged WordPress roles such as Administrator, or paid levels that charge a sign-up fee. The vulnerability was partially patched in version 3.2.18."}, {"lang": "es", "value": "El plugin Membership Plugin \u2013 Restrict Content para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta, e incluyendo, la 3.2.20. Esto se debe a que la funci\u00f3n `rcp_setup_registration_init()` acepta cualquier ID de nivel de membres\u00eda a trav\u00e9s del par\u00e1metro POST `rcp_level` sin validar que el nivel est\u00e9 activo o que se requiera pago. Combinado con el m\u00e9todo `add_user_role()` que asigna el rol de WordPress configurado en el nivel de membres\u00eda sin comprobaciones de estado, esto hace posible que atacantes no autenticados se registren con cualquier nivel de membres\u00eda, incluyendo niveles inactivos que otorgan roles de WordPress privilegiados como Administrador, o niveles de pago que cobran una tarifa de registro. La vulnerabilidad fue parcialmente parcheada en la versi\u00f3n 3.2.18."}], "id": "CVE-2026-1321", "lastModified": "2026-06-17T10:15:35.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1321", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T14:54:54.966669Z", "version": "2.0.3"}}]}, "published": "2026-03-05T08:15:57.957", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/class-rcp-registration.php#L107"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/memberships/class-rcp-membership.php#L1939"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1191"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.15/core/includes/registration-functions.php#L1203"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3447187/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3460177/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abfaa4a6-92b0-4233-b08d-e668090d3fc2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.20]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Membership Plugin \u2013 Restrict Content", "source": "cna", "vendor": "stellarwp"}, "product": "membership_plugin_-_restrict_content", "vendor": "stellarwp"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:52:32.720137+00:00", "value": {"mitigation_remediation": ["Upgrade the Membership Plugin \u2013 Restrict Content to any version newer than\u00a03.2.20, which contains the full patch that validates membership level status before assigning roles.", "If an upgrade cannot be performed immediately, restrict the rcp_level POST parameter to a whitelist of authorized membership levels, or disable public registration altogether to prevent unauthenticated registrations.", "As an additional temporary safeguard, enforce a check that the membership level is active and paid before assigning the WordPress role, or remap any newly created Administrator accounts to a less privileged role."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is the StellarWP Membership Plugin \u2013 Restrict Content. All releases up to and including version\u00a03.2.20 are vulnerable; no other vendors or later versions are listed as affected.", "description_and_impact": "The Membership Plugin \u2013 Restrict Content plugin for WordPress carries a privilege escalation vulnerability that exists in all releases up to version\u00a03.2.20. The flaw is in the rcp_setup_registration_init() function, which accepts the rcp_level POST parameter without verifying that the membership level is active or that a payment is required. Because add_user_role() assigns the WordPress role configured for that level without any status checks, an unauthenticated attacker can register with any level, including inactive levels that grant privileged roles such as Administrator, or paid levels that would normally trigger a sign\u2011up fee. This allows creation of fully privileged user accounts without authentication or payment.", "risk_and_exploitability": "The CVSS\u00a0v3.1 base score for this issue is 8.1 (High), and the EPSS exploitation probability is reported as less than\u00a01%, indicating a low overall likelihood at the present time. The vulnerability is not present in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated HTTP\u00a0POST request to the plugin\u2019s registration endpoint with any desired rcp_level value. Because the plugin does not validate the level against activation or payment status, the user is created and immediately granted the WordPress role associated with the supplied level. The partial patch introduced in version\u00a03.2.18 does not fully mitigate the issue, and exploitation remains possible until a complete fix is applied in later releases."}}}}, "created": "2026-03-06T15:07:59.492595+00:00", "updated": "2026-04-15T18:00:15.481100+00:00", "vendors": ["stellarwp", "stellarwp$PRODUCT$membership_plugin_-_restrict_content", "wordpress", "wordpress$PRODUCT$wordpress"]}