Critical · published October 16, 2024
🚨 Unauthenticated attackers can log in as any user, including administrators, simply by using a username or user ID! 😱 This vulnerability is like an unguarded main entrance to a secured building, where anyone can just stroll in and impersonate the boss — no ID check required! 🏢 An attacker could exploit this flaw to take over any account, including the site administrator, leading to unauthorized access to sensitive data, site settings, and the potential for devastating misuse of the entire platform! This could easily result in a complete compromise of the website's integrity.
This vulnerability is like an unguarded main entrance to a secured building, where anyone can just stroll in and impersonate the boss — no ID check required! 🏢 The Ultimate Membership Pro plugin for WordPress allows an authentication bypass in versions 7.3 to 8.6, enabling attackers to log in without proper credentials by simply manipulating the username or user ID.
An attacker could exploit this flaw to take over any account, including the site administrator, leading to unauthorized access to sensitive data, site settings, and the potential for devastating misuse of the entire platform! This could easily result in a complete compromise of the website's integrity. Update the Ultimate Membership Pro plugin immediately to version 8.7 or later to close this critical vulnerability. Additionally, review user permissions and monitor for any suspicious activity to ensure your site is secure. You've got this! Follow these steps, and you'll seal off that entrance in no time! 🛡️