PT-2024-38383 · WordPress · Wpcom Member

Name of the Vulnerable Software and Affected Versions: WPCOM Member plugin for WordPress versions up to 1.5.2.1 Description: The issue is due to the plugin allowing arbitrary data to be passed to wp insert user during registration, making it possible for unauthenticated attackers to update their...

CVE-2024-7493: Improper Privilege Management

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wpinsertuser during registration. This makes it possible for unauthenticated attackers to update their role ...