Critical · published March 1, 2025
🚨 An unauthenticated attacker could waltz right in and impersonate any user, including site admins, thanks to a flaw in the Academist Membership plugin for WordPress! 🔥 Think of it like a restaurant where the host doesn’t check reservations — anyone can walk in, sit at the finest table, and pretend to be a VIP guest. Without proper identity checks, this plugin leaves the digital door wide open! This vulnerability allows attackers to escalate privileges and gain unauthorized access to sensitive areas of the site. They could change settings, delete content, or even manage user accounts, leading to potentially devastating consequences for the entire website and its users.
Think of it like a restaurant where the host doesn’t check reservations — anyone can walk in, sit at the finest table, and pretend to be a VIP guest. Without proper identity checks, this plugin leaves the digital door wide open! The Academist Membership plugin fails to properly verify user identity in the academist_membership_check_facebook_user() function, allowing unauthorized access for unauthenticated users.
This vulnerability allows attackers to escalate privileges and gain unauthorized access to sensitive areas of the site. They could change settings, delete content, or even manage user accounts, leading to potentially devastating consequences for the entire website and its users. Patch to version 1.1.7 or later immediately to close this vulnerability. Additionally, review user roles and permissions to ensure no unauthorized access has occurred. Regularly monitor your site for any suspicious activity. You’ve got this! Follow these steps, and you’ll be on your way to securing your WordPress site in no time! 🛡️