A critical privilege management vulnerability in the MemberGlut WordPress plugin allows unauthenticated attackers to gain administrative access.

This vulnerability involves improper privilege management within the plugin registration flow. An unauthenticated attacker can manipulate registration requests to assign themselves arbitrary roles, such as administrator.

The ability for an unauthenticated user to escalate privileges to administrator status represents a total compromise of the affected WordPress site. Given the CVSS score of 9.8, this vulnerability poses an extreme risk of data exfiltration, site defacement, and potential installation of persistent backdoors.

Immediate Action: Update the MemberGlut plugin to version 1.1.5 or higher immediately to enforce proper role validation.

Proactive Monitoring: Audit user account creation logs for suspicious administrator registrations or unusual account creation patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious registration attempts or restrict access to the registration endpoint for untrusted networks.

Public Exploit Available: Unknown.

This is a critical security vulnerability that allows full site takeover without authentication. Administrators must prioritize updating the MemberGlut plugin immediately. If an update is not immediately feasible, consider disabling public registration functionality to prevent exploitation.