CyberRota Analysis
AI-GeneratedThe User Registration & Membership plugin for WordPress prior to version 5.2.3 is vulnerable due to insufficient validation of membership tiers during public registration, enabling unauthenticated users to register for any available membership tier, including potentially gaining administrator privileges. This flaw poses a significant risk to WordPress sites utilizing the affected plugin, as it can lead to unauthorized access and control over the site. Website administrators and security teams should prioritize updating to the latest version to mitigate this high-severity vulnerability.
Original NVD Description
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.