Divi Membership
Monthly
Unauthenticated privilege escalation in the Divi Membership plugin for WordPress (versions up to and including 2.2.0) lets any site visitor create a brand-new account with the administrator role and, by also submitting auto_login=on, be logged in as that administrator within the same request - resulting in complete site takeover. The flaw (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) sits in dmem_form_submit_handler(), which derives the new user's role by iterating every WordPress role and calling password_verify() against an attacker-supplied bcrypt hash in the form_id POST parameter, with no whitelist of permitted roles. The only prerequisite is a WordPress nonce, which is publicly emitted on any page that renders the Divi Membership registration form and is therefore readable by any unauthenticated visitor; no public exploit code has been identified at time of analysis.
Any WordPress site running the Divi Membership plugin at version 2.3.0 or earlier can be fully taken over by an unauthenticated remote attacker who simply requests a crafted URL, because the plugin unconditionally trusts an attacker-supplied user ID and issues a valid WordPress authentication cookie for it. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-287 improper authentication, exploitation requires no authentication, no user interaction, and no non-default configuration, making it a top-priority issue for affected sites. Notably, the vulnerable code path is registered on every front-end request even if PayPal is disabled or never configured, so the common assumption that an unconfigured payment gateway is harmless does not hold here; no public exploit code has been identified at time of analysis, but the attack is a single GET parameter and requires no tooling.
Unauthenticated privilege escalation in the Divi Membership plugin for WordPress (versions up to and including 2.2.0) lets any site visitor create a brand-new account with the administrator role and, by also submitting auto_login=on, be logged in as that administrator within the same request - resulting in complete site takeover. The flaw (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) sits in dmem_form_submit_handler(), which derives the new user's role by iterating every WordPress role and calling password_verify() against an attacker-supplied bcrypt hash in the form_id POST parameter, with no whitelist of permitted roles. The only prerequisite is a WordPress nonce, which is publicly emitted on any page that renders the Divi Membership registration form and is therefore readable by any unauthenticated visitor; no public exploit code has been identified at time of analysis.
Any WordPress site running the Divi Membership plugin at version 2.3.0 or earlier can be fully taken over by an unauthenticated remote attacker who simply requests a crafted URL, because the plugin unconditionally trusts an attacker-supplied user ID and issues a valid WordPress authentication cookie for it. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-287 improper authentication, exploitation requires no authentication, no user interaction, and no non-default configuration, making it a top-priority issue for affected sites. Notably, the vulnerable code path is registered on every front-end request even if PayPal is disabled or never configured, so the common assumption that an unconfigured payment gateway is harmless does not hold here; no public exploit code has been identified at time of analysis, but the attack is a single GET parameter and requires no tooling.