CVE-2024-7493 WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wpinsertuser during registration. This makes it possible for unauthenticated attackers to update their role ...

WordPress WPCOM Member Plugin <= 1.5.2.1 is vulnerable to Privilege Escalation

Software WPCOM Member Type Plugin Vulnerable versions = 1.5.2.1 Fixed in 1.5.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-7493 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID db48b9c1d64f Credits wesley...