CVE-2024-7493: WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta
The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wpinsertuser() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7493?
CVE-2024-7493 has been classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-7493?
To fix CVE-2024-7493, update the WPCOM Member plugin to version 1.5.3 or later.
Who is affected by CVE-2024-7493?
CVE-2024-7493 affects all versions of the WPCOM Member plugin for WordPress up to and including version 1.5.2.1.
What type of vulnerability is CVE-2024-7493?
CVE-2024-7493 is a privilege escalation vulnerability that allows unauthenticated attackers to manipulate user registration processes.
What can attackers do with CVE-2024-7493?
Attackers exploiting CVE-2024-7493 can gain unauthorized access to administrative privileges by injecting arbitrary data during user registration.