Critical · published November 27, 2025
🚨 An unauthenticated user could register as an 'administrator' and take over your WordPress site! 🔥 Imagine an open house where anyone can walk in and claim they own the place, bypassing all the security checks. That’s exactly what’s happening here, as the Tiare Membership plugin fails to ensure only the right people get the keys to your digital kingdom. If exploited, an attacker can gain full administrative access to your site, potentially leading to data theft, defacement, or even complete control over your content. This isn't just a minor breach; it's an open invitation for chaos that could compromise your entire website's integrity. Absolutely devastating!
Imagine an open house where anyone can walk in and claim they own the place, bypassing all the security checks. That’s exactly what’s happening here, as the Tiare Membership plugin fails to ensure only the right people get the keys to your digital kingdom. This privilege escalation vulnerability in the Tiare Membership plugin allows attackers to register with the 'administrator' role without any authentication checks. The function 'tiare_membership_init_rest_api_register' does not properly enforce user role restrictions during the registration process.
If exploited, an attacker can gain full administrative access to your site, potentially leading to data theft, defacement, or even complete control over your content. This isn't just a minor breach; it's an open invitation for chaos that could compromise your entire website's integrity. Absolutely devastating! To safeguard your site, update the Tiare Membership plugin to version 1.3 immediately, where this vulnerability is patched. Additionally, review user role assignments and implement appropriate user registration controls to prevent unauthorized role assignments in the future. You’ve got this! Follow these steps and you’ll lock down your site in no time. 🛡️