User Registration & Membership WordPress Plugin Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the User Registration & Membership WordPress plugin, affecting versions prior to 4.1.3. When the Membership Addon is enabled, the plugin fails to properly validate data in an AJAX action. This flaw allows attackers to authenticate as any user, including administrators, by simply using the target account's user ID.

Impact

Exploitation of this vulnerability allows for unauthorized authentication, potentially leading to privileged actions if an administrator account is targeted.

Remediation

Users of the User Registration & Membership WordPress plugin should update to version 4.1.3 or later. For the Pro version, update to version 5.1.3 or later.