Paid Membership Plugin Ecommerce User Registration Form Login Form User Profile Restrict Content
Monthly
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.