User Registration and Membership Plugin Missing Authorization Vulnerability on WordPress

A vulnerability exists in the User Registration & Membership plugin for WordPress, specifically in versions through 5.1.4. The issue arises from a lack of proper capability checks in the 'embed_form_action()' function, allowing authenticated attackers with Contributor-level access or higher to unauthorizedly modify page content. This can be exploited by appending shortcode to pages that the attacker does not own or cannot edit.

Impact

Exploitation of this vulnerability allows for unauthorized modification of page content, specifically through the addition of shortcodes that can be executed on the page.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access can use the 'embed_form_action()' function without the necessary capability checks. This can be done by sending a request that includes the 'page_id' and 'form_id' parameters, targeting a page that the user does not own or have permission to edit.

Remediation

Users are advised to update the User Registration & Membership plugin to version 5.1.5 or later.