User Registration and Membership WordPress Plugin Improper Privilege Management Vulnerability

A vulnerability exists in the User Registration & Membership WordPress plugin, specifically in versions through 5.1.2. The issue stems from improper privilege management, as the plugin allows users to specify roles during membership registration without adequate server-side validation. This flaw enables unauthenticated attackers to create administrator accounts by manipulating the role value during the registration process.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative privileges on the WordPress site.

Remediation

Users can update to version 5.1.3 or a newer patched version to address this vulnerability.