A critical authentication bypass vulnerability in the WPEverest User Registration & Membership plugin allows unauthenticated attackers to gain unauthorized access to newly registered user accounts.

The plugin contains an authentication bypass flaw in the register_member function (CWE-288) that allows unauthenticated attackers to log in as users who have the urm_user_just_created meta key assigned.

This vulnerability poses a significant risk to site integrity and user data privacy. By bypassing authentication mechanisms, an attacker can gain unauthorized access to accounts, potentially leading to privilege escalation or the exfiltration of sensitive member information. The CVSS score of 8.1 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: There is no patch available at this time; administrators should immediately deactivate and remove the User Registration & Membership plugin until a security update is released by the vendor.

Proactive Monitoring: Monitor WordPress user logs and database activity for suspicious registration patterns or unexpected logins associated with the urm_user_just_created meta value.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious requests targeting the AJAX endpoints associated with the plugin registration module.

Public Exploit Available: No (exploit_available: false)

Given the severity of this authentication bypass, immediate action is required to secure the environment. Administrators should prioritize deactivating the plugin and monitoring for unauthorized account activity until the vendor provides a verified fix. Failure to mitigate this risk could result in widespread unauthorized access to user accounts.