ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4056

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rule…

Published Mar 24, 2026 · updated Jun 17, 2026

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the method only checking for capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 24, 2026 · NIST NVD

    Detected

    The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the method only checking for capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level acc

  2. Jun 17, 2026 · NIST NVD

    Updated

    The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the method only checking for capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level acc

Sources

  • CVE.orgVulnerability recordCVE-2026-4056

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4056

    The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the method only checki

    nvd.nist.gov

References