Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An attacker can exploit it to gain complete control over a WordPress website without needing any prior authentication. This includes the ability to modify content, install malicious plugins, steal sensitive data, and potentially pivot to other systems on the network. The ease of exploitation, combined with the widespread use of WordPress, makes this a high-priority risk. Successful exploitation effectively compromises the entire WordPress installation and any data stored within it.

WordPress websites utilizing the Tiare Membership plugin, particularly those with limited security hardening or those running older, unpatched versions of the plugin, are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / plugin: Use wp-cli to check the plugin version:

wp plugin list | grep tiare-membership

• wordpress / plugin: Search plugin files for the vulnerable function tiaremembershipinitrestapi_register using grep:

grep -r 'tiare_membership_init_rest_api_register' /path/to/wp-content/plugins/tiare-membership/

• wordpress / logs: Monitor WordPress access logs for POST requests to /wp-json/tiare-membership/v1/register with suspicious parameters, particularly those attempting to set the role to 'administrator'. • generic web: Check for unusual user registration patterns via curl:

curl -X POST -d 'username=test&[email protected]&role=administrator' http://your-wordpress-site.com/wp-json/tiare-membership/v1/register

1. 2025-11-27Disclosure

   disclosure

2. 2025-11-27Patch

   patch

1. Reserviert2025-11-22
2. Veröffentlicht2025-11-27
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the Tiare Membership plugin to version 1.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user registration to known, trusted administrators. While not a complete solution, this can limit the potential for new, unauthorized administrator accounts. Monitor WordPress logs for suspicious registration attempts, particularly those attempting to assign the 'administrator' role. After upgrading, verify the fix by attempting a new user registration without authentication and confirming that the 'administrator' role cannot be selected.