Critical Vulnerability in User Registration & Membership Plugin for WordPress Enables Unauthenticated Admin Access

A critical vulnerability has been discovered in the User Registration & Membership plugin for WordPress, impacting over 60,000 websites. The flaw, rated 9.8/10 in severity, allows unauthenticated attackers to create administrator-level accounts, effectively granting them complete control of affected sites.

What is the User Registration & Membership Plugin?

The User Registration & Membership plugin is a popular tool used to build membership websites on WordPress. It provides features for creating custom registration forms, managing user roles, restricting content access based on subscription plans, and processing payments for membership tiers. WordPress.org

The Unauthenticated Privilege Escalation Vulnerability

The vulnerability, affecting all versions up to and including 5.1.2, stems from improper privilege management during the membership registration process. The plugin fails to enforce a server-side allowlist of permitted user roles when a latest user registers. This allows attackers to specify “administrator” as their role during registration, bypassing normal security controls.

A server-side allowlist is a crucial security measure that restricts the roles users can assign themselves during registration. Without this restriction, the plugin accepts any role value submitted by the user.

What Can Attackers Do?

Successful exploitation of this vulnerability allows unauthenticated attackers to create administrator accounts. An administrator account possesses full control over a WordPress website, enabling attackers to:

• Install or delete plugins
• Modify themes
• Upload malicious code
• Create or delete user accounts
• Access sensitive site data

Essentially, gaining administrator access provides an attacker with complete control over the website. According to Wordfence, “This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.”

Affected and Patched Versions

All versions of the User Registration & Membership plugin up to and including 5.1.2 are vulnerable. The vulnerability has been patched in version 5.1.3. This update restricts the roles that can be assigned during registration, preventing users from submitting elevated roles like administrator. WordPress.com

What Site Owners Should Do

If you are using the User Registration & Membership plugin, it is critical to update to version 5.1.3 or newer immediately. Because the vulnerability does not require authentication, websites running vulnerable versions are at immediate risk of administrator account creation by attackers. Updating the plugin effectively removes the ability for unauthorized users to assign privileged roles during registration.

Key Takeaways

• A critical vulnerability exists in the User Registration & Membership plugin for WordPress.
• The vulnerability allows unauthenticated attackers to create administrator accounts.
• All versions up to and including 5.1.2 are affected.
• Update to version 5.1.3 or newer to mitigate the risk.