User Registration and Membership WordPress Plugin Missing Authorization Vulnerability Bypassing Admin Approval

A vulnerability exists in the User Registration & Membership plugin for WordPress, affecting all versions through 5.1.5. The issue stems from the is_admin_creation_process() method, which improperly relies on the action=createuser parameter in the $_REQUEST superglobal. This approach lacks necessary authentication or capability checks, allowing unauthenticated attackers to circumvent admin approval when registering new accounts via the fallback submission method.

Impact

Exploitation of this vulnerability allows unauthenticated users to bypass the admin approval process for new user registrations, potentially leading to unauthorized access or privileges.

Remediation

Users can update to version 5.1.6 or a newer patched version to address this vulnerability.