User Registration Membership Pro
Monthly
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.