Memberhero
Monthly
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a subscriber-level account - to invoke an AJAX action that has no capability or nonce check and make the site send arbitrary HTML email from its own mail system to arbitrary recipients. The practical impact is outbound mail relay used for phishing that carries the victim site's domain and sending reputation, with no direct data disclosure or code execution; the assessed CVSS vector (PR:L, I:L, no C/A impact) keeps this at medium severity (CVSS 4.3). Publicly available exploit code exists, and there is no KEV entry confirming active exploitation; the primary gating factor is authentication, which is trivially obtained on membership sites that permit open self-service registration.
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a subscriber-level account - to invoke an AJAX action that has no capability or nonce check and make the site send arbitrary HTML email from its own mail system to arbitrary recipients. The practical impact is outbound mail relay used for phishing that carries the victim site's domain and sending reputation, with no direct data disclosure or code execution; the assessed CVSS vector (PR:L, I:L, no C/A impact) keeps this at medium severity (CVSS 4.3). Publicly available exploit code exists, and there is no KEV entry confirming active exploitation; the primary gating factor is authentication, which is trivially obtained on membership sites that permit open self-service registration.
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.