Read the docs
TI-2026-69984 Aliases CVE-2026-62040GHSA-92m4-mg5f-62gp

Missing authorization in Restrict User Access WordPress plugin

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Restrict User Access Membership Plugin with Force for WordPress by DEV Institute, versions from n/a through 2.8.1, has a missing authorization check (CWE-862). Incorrectly configured access control security levels can be exploited to bypass intended restrictions. An unauthenticated remote attacker can read limited information over the network without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DEV InstituteRestrict User Access – Membership Plugin with Forceup to 2.8.1—No fix listedCNA
  • Restrict User Access – Membership Plugin with Force VendorDEV Institute Affected up to 2.8.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for the Restrict User Access Membership Plugin with Force.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-62040
  2. 2026-10-09 Alias added: GHSA-92m4-mg5f-62gp
  3. 2026-10-10 CISA SSVC decision points changed
  4. 2026-10-14 Title updated · CNA

References

Other 1

  • TI-2024-19311 WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-00633 Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences