Description
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
Exploits & proofs of concept
- nucleiUser Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalationby iamnoooob,rootxharsh,pdresearch
Updated 28m ago · 8 sources