What’s Vulnerable › Vulnerabilities

CVE-2024-7493: WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-06 · updated 2026-06-17
• Weakness: CWE-269

Description

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration.

Affected products

• whyun WPCOM Member: before 1.5.3 — fixed in 1.5.3

How to fix

Upgrade to a fixed version: whyun WPCOM Member 1.5.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.5.2/includes/form-validation.php#L267
• https://plugins.trac.wordpress.org/changeset/3147399/wpcom-member/trunk/includes/form-validation.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7f3e0c-a07c-4082-9b6b-12d0fbe0fdc8?source=cve

Get alerted when CVE-2024-7493 or the next vulnerability affects your stack