CVE-2026-124271: WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects DEV Institute Restrict User Access – Membership Plugin with Force versions through 2.8.3. The available data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The reported vector is network-based, with low attack complexity, no required privileges, and no user interaction. Exploitation involves bypassing incorrectly configured access-control security levels.

Q: What is the expected impact?

The vulnerability has a medium severity score of 5.3 and is rated for low confidentiality impact, with no reported integrity or availability impact.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/restrict-user-access-membership-plugin-with-force to a version that resolves this vulnerability.
Fixed in 2.8.4

Event History

Nov 11, 2026

CVE Published

via MITRE·11:35 AM

Data Sourced

via MITRE·11:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects DEV Institute Restrict User Access – Membership Plugin with Force versions through 2.8.3. The available data does not identify a fixed version.

What does an attacker need to exploit this issue?

The reported vector is network-based, with low attack complexity, no required privileges, and no user interaction. Exploitation involves bypassing incorrectly configured access-control security levels.

What is the expected impact?

The vulnerability has a medium severity score of 5.3 and is rated for low confidentiality impact, with no reported integrity or availability impact.

CVE-2026-124271: WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the expected impact?