CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `embed_form_action()` function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to append shortcode content to arbitrary pages they do not own or have permission to edit.
Explanation of Vulnerability in Simple Terms
User Registration & Membership plugin for WordPress contains an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability affects versions up to 5.1.4. An attacker with a low-privilege account can alter information through the plugin's interface without proper permission checks. Site administrators should update to a version newer than 5.1.4 to remediate this issue.
What an attacker can do
Modify data or settings in the plugin that their user role should not permit.
Potential impact on your site
Unauthorized changes to user registration, membership, or subscription settings by low-privilege accounts.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least subscriber-level access.
Key dates
External resources
Related vulnerabilities
