CVE-2026-4056

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the `check_permissions()` method only checking for `edit_posts` capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to list, create, modify, toggle, duplicate, and delete site-wide content restriction rules, potentially exposing restricted content or denying legitimate user access.

• CWE-862

• https://plugins.trac.wordpress.org/browser/user-registration/tags/5.1.1/modules/content-restriction/includes/RestApi/controllers/version1/class-urcr-content-access-rules.php#L116
• https://plugins.trac.wordpress.org/browser/user-registration/trunk/modules/content-restriction/includes/RestApi/controllers/version1/class-urcr-content-access-rules.php#L116
• https://plugins.trac.wordpress.org/changeset/3485702/user-registration/trunk/modules/content-restriction/includes/RestApi/controllers/version1/class-urcr-content-access-rules.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb5a5a2-9644-4850-a5f9-7c925af000c8?source=cve

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40550mpGabinet is vulnerable to Privilege Escalation due to exces…6.9
• CVE-2026-40551mpGabinet performs client-side authentication. An attacker w…8.4
• CVE-2026-40552mpGabinet is vulnerable to Remote Command Execution. An auth…4.7
• CVE-2026-40553Buffer overflow vulnerability has been found in "extension/r…7.5
• CVE-2026-40556Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-40557Improper Certificate Validation via Global SSL Context Downg…4.8
• CVE-2026-40560Starman versions before 0.4018 for Perl allows HTTP Request …7.5
• CVE-2026-40561Starlet versions through 0.31 for Perl allows HTTP Request S…5.3
• CVE-2026-40562Gazelle versions through 0.49 for Perl allows HTTP Request S…7.5
• CVE-2026-40563Description: Improper Control of Generation of Code ('Code I…8.1
• CVE-2026-40564Files or Directories Accessible to External Parties, Server-…6.5
• CVE-2026-40565FreeScout is a free self-hosted help desk and shared mailbox…6.1