UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An attacker can exploit it to gain complete control over a WordPress site by creating a new user account and assigning themselves the administrator role. This grants them full access to all site data, including sensitive information like user credentials, financial data, and proprietary content. They can modify website content, install malicious plugins, and even delete the entire site. The ease of exploitation, requiring only a crafted user registration request, significantly increases the risk of widespread compromise.

WordPress websites utilizing the UrbanGo Membership plugin, particularly those with open user registration enabled, are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk due to the potential for cross-site contamination.

• wordpress / composer / npm:

grep -r 'user_register_role' /var/www/html/wp-content/plugins/urban-go-membership/

• wordpress / composer / npm:

wp plugin list --status=active | grep urban-go-membership

• wordpress / composer / npm:

wp plugin update urban-go-membership

1. 2025-04-19Disclosure

   disclosure

1. Reserviert2025-04-04
2. Veröffentlicht2025-04-19
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the UrbanGo Membership plugin to a patched version. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration or implementing stricter role assignment controls. WordPress administrators should also review user accounts for any suspicious administrator accounts created around the time of the vulnerability's public disclosure. Implement a Web Application Firewall (WAF) rule to block requests containing the 'userregisterrole' parameter. Regularly audit user roles and permissions to identify and remove any unauthorized administrator accounts.