Login Request a demo
Critical severity · published Sep 6, 2024
CVE-2024-7493
WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WPCOM Member · whyun
through 1.5.2.1 · source: vendor, NVD
WP
Wpcom-member · Wpcom
through 1.5.2.1 · source: CISA
Affected product
WM
WPCOM Member
whyun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7493
Issue Tracking
https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.5.2/includes/form-validation.php#L267
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3147399/wpcom-member/trunk/includes/form-validation.php
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7f3e0c-a07c-4082-9b6b-12d0fbe0fdc8?source=cve
More from WPCOM Member
9.8
CVE-2026-104803
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVE-2025-1475
WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
8.8
CVE-2025-11920
WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode
8.1
CVE-2025-14002
WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP
7.5
CVE-2025-2221
WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection