{"id":"CVE-2026-115600","kind":"vulnerability","aliases":["CVE-2026-115600"],"related":[],"title":"WordPress membership plugin: missing authorization lets users bypass access restrictions","description":"Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3.","summary":"Restrict User Access – Membership Plugin with Force, a WordPress plugin by DEV Institute, has a missing authorization check that lets people get access controls wrong. Per the description, the issue affects versions up to and including 2.8.3.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"restrict-user-access","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["membership-plugins","package","restrict-user-access","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Restrict User Access – Membership Plugin with Force in the WordPress admin plugin list or the plugin's `restrict-user-access` directory.","fix":"- Versions above `2.8.3` are the affected range's boundary; the fixed version is unknown from the sources.","status":"open","published_at":"2026-11-11T12:18:53+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:29:00+00:00","updated_at":"2026-11-11T12:29:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `2.8.3` are the affected range's boundary; the fixed version is unknown from the sources.","reach":"internet","title":"WordPress membership plugin: missing authorization lets users bypass access restrictions","impact":"medium","summary":"Restrict User Access – Membership Plugin with Force, a WordPress plugin by DEV Institute, has a missing authorization check that lets people get access controls wrong. Per the description, the issue affects versions up to and including 2.8.3.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","restrict-user-access","membership-plugins"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass on member-restricted content","analyst_note":"Find the fixed version and the exact trigger from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115600.","how_to_check":"- Check the installed version of Restrict User Access – Membership Plugin with Force in the WordPress admin plugin list or the plugin's `restrict-user-access` directory.\n- unknown","plain_action":"","product_name":"restrict-user-access","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Restrict User Access – Membership Plugin with Force WordPress plugin, version 2.8.3 or earlier, are in the affected range. The sources do not describe the exact configuration or role needed to trigger the flaw, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4560,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115600':13A,16A '-2026':12A,15A '2.8.3':66B,104C 'access':9A,20A,28B,32B,52B,75C,83C,88C,96C 'affect':60B,93C 'allow':84C 'author':5A,46B,68C 'bypass':8A 'check':47B 'configur':87C 'control':53B,89C 'cve':11A,14A 'descript':57B 'dev':41B,71C 'exploit':85C 'forc':36B,79C,100C 'get':51B 'includ':65B 'incorrect':86C 'institut':42B,72C 'issu':59B,92C 'let':6A,49B 'levels.this':91C 'membership':2A,22B,33B,76C,97C 'membership-plugin':21B 'miss':4A,45B,67C 'n/a':102C 'packag':24B 'peopl':50B 'per':55B 'plugin':3A,23B,34B,39B,77C,98C 'restrict':10A,18A,26B,30B,73C,81C,94C 'restrict-user-access':17A,25B,80C 'secur':90C 'user':7A,19A,27B,31B,74C,82C,95C 'version':61B 'vulner':69C 'wordpress':1A,29B,38B 'wrong':54B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Restrict User Access – Membership Plugin with Force WordPress plugin, version 2.8.3 or earlier, are in the affected range. The sources do not describe the exact configuration or role needed to trigger the flaw, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["restrictuseraccess"],"ptokens":["access","restrict","user"],"labels":["medium","membershipplugins","package","restrictuseraccess","vendor","wordpress"],"campaign_type":null,"search_a":"'-115600':13A,16A '-2026':12A,15A 'access':9A,20A 'author':5A 'bypass':8A 'cve':11A,14A 'let':6A 'membership':2A 'miss':4A 'plugin':3A 'restrict':10A,18A 'restrict-user-access':17A 'user':7A,19A 'wordpress':1A","search_b":"'2.8.3':66B 'access':28B,32B,52B 'affect':60B 'author':46B 'check':47B 'control':53B 'descript':57B 'dev':41B 'forc':36B 'get':51B 'includ':65B 'institut':42B 'issu':59B 'let':49B 'membership':22B,33B 'membership-plugin':21B 'miss':45B 'packag':24B 'peopl':50B 'per':55B 'plugin':23B,34B,39B 'restrict':26B,30B 'restrict-user-access':25B 'user':27B,31B 'version':61B 'wordpress':29B,38B 'wrong':54B","search_c":"'2.8.3':104C 'access':75C,83C,88C,96C 'affect':93C 'allow':84C 'author':68C 'configur':87C 'control':89C 'dev':71C 'exploit':85C 'forc':79C,100C 'incorrect':86C 'institut':72C 'issu':92C 'levels.this':91C 'membership':76C,97C 'miss':67C 'n/a':102C 'plugin':77C,98C 'restrict':73C,81C,94C 'restrict-user-access':80C 'secur':90C 'user':74C,82C,95C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115600","severity":null,"published_at":"2026-11-11T12:18:53+00:00","modified_at":"2026-11-11T12:18:53+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}