Critical · published April 19, 2025
🚨 An unauthenticated attacker can create an account with admin privileges! The UrbanGo Membership plugin for WordPress has a critical vulnerability that invites trouble. 🔥 Think of it as a restaurant where anyone can simply walk in, fill out a special form, and become the head chef! No one checks their credentials—so they can whip up chaos in the kitchen without anyone batting an eye. This flaw allows a malicious actor to register as an administrator, potentially leading to full control over your WordPress site. They could manipulate data, install malicious plugins, or even delete your entire site—absolutely devastating!
Think of it as a restaurant where anyone can simply walk in, fill out a special form, and become the head chef! No one checks their credentials—so they can whip up chaos in the kitchen without anyone batting an eye. The UrbanGo Membership plugin permits users registering new accounts to set their own role via a 'user_register_role' field, allowing unauthorized users to gain elevated privileges, including the administrator role.
This flaw allows a malicious actor to register as an administrator, potentially leading to full control over your WordPress site. They could manipulate data, install malicious plugins, or even delete your entire site—absolutely devastating! Update the UrbanGo Membership plugin to version 1.0.5 or later immediately! Additionally, audit your user accounts to ensure no unauthorized administrator roles have been assigned. Don’t forget to review your site permissions to bolster security further! You've got this! Follow these steps and protect your site from becoming an attacker’s playground! 🛡️