The StellarWP Membership Plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative access to affected sites.

The flaw exists within the rcp_setup_registration_init() function, which fails to validate the rcp_level POST parameter during registration. This allows unauthenticated users to assign themselves any membership level, including those granting administrative privileges, by manipulating the registration request.

Successful exploitation of this vulnerability results in full administrative compromise of the WordPress environment. This level of access permits an attacker to exfiltrate sensitive data, modify site content, install malicious plugins, or pivot to the underlying server infrastructure. Given the CVSS score of 8.1, this represents a high-severity threat to organizational integrity and data confidentiality.

Immediate Action: Update the Membership Plugin – Restrict Content to the latest available version beyond 3.2.20 to ensure the rcp_level parameter validation is correctly enforced.

Proactive Monitoring: Audit WordPress user accounts for unauthorized administrative accounts and monitor registration logs for irregular POST requests directed at the plugin registration endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and block registration requests that attempt to pass arbitrary membership level identifiers in the rcp_level parameter.

Public Exploit Available: Unknown

Organizations utilizing the StellarWP Membership Plugin must prioritize this update immediately. Because this vulnerability allows for complete site takeover without requiring prior authentication, it poses an existential risk to the platform. Administrators should verify that all plugins are updated and perform a thorough review of existing administrative accounts to identify any unauthorized additions occurring prior to the patch application.