User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.1epss 46%
from disclosure to weapon0 days
Published on NVDApr 14
1st PoCMar 29
metasploitMar 24
VulnCheckMar 25
exploitation probability
46%top 1% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · User Registration & Membershippublic PoCs found — 3
vulncheckvulncheck.com/xdb/d6877a5553d3unverifiedvulncheckvulncheck.com/xdb/c786236128a3unverifiedvulncheckvulncheck.com/xdb/35e0d06cfa1aunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.