A Privilege Escalation vulnerability has been identified in the WordPress Simple Membership Plugin. This vulnerability could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this, they could take full control of the website if high privileges are gained.

This vulnerability was discovered and responsibly reported by Rafie Muhammad (Patchstack).

The vulnerability is a Privilege Escalation vulnerability that occurs in the simple-membership.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to escalate their privileges on the website.

Severity:

The vulnerability has a CVSS 3.1 score of 8.8, which is considered to be high. This means that the vulnerability is likely to be exploited and could have a significant impact on the affected system.

Affected Versions:

The vulnerability affects all versions of the Simple Membership Plugin prior to 4.3.5.

Impact:

An attacker who successfully exploits this vulnerability could:

  • Privilege Escalation: Escalate their low privileged account to something with higher privileges.
  • Full Website Control: Take full control of the website if high privileges are gained.

Recommendation:

Users of the Simple Membership Plugin can take the following actions to secure their WordPress website:

  • Update the Plugin: Users of the Simple Membership Plugin are strongly advised to update to the latest available version (at least 4.3.5) as soon as possible. This vulnerability has been fixed in version 4.3.5. This update contains the critical security fixes necessary to address the Privilege Escalation vulnerability.
  • Enhance Security Measures: Consider implementing additional security measures such as web application firewalls (WAFs), strong authentication protocols, and regular security audits. A comprehensive security strategy is essential to minimize potential exploitation attempts.

 

Conclusion:

This vulnerability is a serious threat to the security of WordPress websites that use the Simple Membership Plugin. Users are strongly advised to update to the latest available version (at least 4.3.5) as soon as possible.