Privilege Escalation in WordPress Membership Plugin via Role Injection

Executive Summary

The vulnerability exists in the User Registration & Membership plugin for WordPress, versions up to and including 5.1.2. It is caused by improper privilege management where the plugin accepts a user-supplied role during membership registration without enforcing a server-side allowlist. This flaw allows unauthenticated attackers to create administrator accounts by specifying a role value during registration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to create administrator accounts on the affected WordPress site. With administrator privileges, attackers can fully control the site, including modifying content, installing malicious code, stealing sensitive data, and disrupting site operations.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the User Registration & Membership plugin to version 5.1.3 or later, as this version includes a comprehensive overhaul likely addressing the security issue.

This update involves extensive code changes across many files, indicating fixes to privilege management and role assignment during membership registration.

Until the update can be applied, restrict access to the membership registration functionality and monitor for suspicious account creations with elevated privileges.

Useful 0 Not Useful 0