User Registration and Membership WordPress Plugin Missing Authorization Vulnerability in Content Access Rules API

A vulnerability exists in the User Registration & Membership plugin for WordPress, specifically in versions 5.0.1 prior to 5.1.4. The issue arises from a missing capability check on the Content Access Rules REST API endpoints, allowing unauthorized data modification. The 'check_permissions()' method only verifies 'edit_posts' capability, rather than requiring administrator-level access. This flaw enables authenticated attackers with Contributor-level access and above to manipulate site-wide content restriction rules, including listing, creating, modifying, toggling, duplicating, and deleting rules. Such actions could inadvertently expose restricted content or disrupt access for legitimate users.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of content access rules, potentially allowing restricted content to be accessed or legitimate users to be denied access.

Remediation

Users are advised to update the User Registration & Membership plugin to version 5.1.5 or a newer patched version.