DEV Institute Restrict User Access WordPress plugin: Missing authorization
Summary
The WordPress plugin Restrict User Access – Membership Plugin with Force up to and including version 2.8.3 contains a missing authorization check (CWE-862). An unauthenticated remote attacker may be able to reach restricted functionality and view content they should not access. The advisory gives no detail on which content or functions are affected, and the exact impact is unknown.
Affected
- Restrict User Access – Membership Plugin with Force (WordPress plugin) versions 0 through 2.8.3
Fixed in
- Version 2.8.4 (according to Patchstack and the CVE record; not yet confirmed by the vendor or wordpress.org changelog)
Workaround
- Unknown. No vendor mitigation guidance was found for sites that cannot be patched.
Exploitation
- Not known to be exploited (OffSeq). Not listed in CISA KEV (Strix).
- No public proof of concept found; monitoring is early as the record was published on 11 Nov 2026.
Our recommendation
- Inventory WordPress sites that use this plugin and check for version 2.8.3 or earlier.
- Verify version 2.8.4 on wordpress.org and in the changelog, then update in the next maintenance window, or sooner for members-only or paid-content sites.
- Review web server access logs for requests to restricted content.
- Confirm that the update also covers related CVE-2026-62040 and possible duplicate CVE-2026-124271.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- CVE Record CVE-2026-115600 www.cve.org
- OffSeq threat radar radar.offseq.com
- Strix CVE record www.strix.ai
- Related CVE-2026-62040 (OpenCVE) app.opencve.io
- Plugin page on wordpress.org wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:53.
Original description (NVD)
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.