A critical privilege escalation vulnerability in the Ultimate Member WordPress plugin allows unauthenticated attackers to grant themselves administrative capabilities during account registration.

The vulnerability is categorized as Improper Privilege Management (CWE-269). It occurs because the plugin fails to validate submitted role selections against an allow-list during the registration process, permitting unauthenticated actors to assign themselves elevated roles.

The potential for unauthorized privilege escalation represents a severe risk to organizational security and data integrity. By gaining administrator-level access, an attacker could compromise the entire WordPress environment, perform unauthorized data exfiltration, or deploy malicious content, leading to significant reputational and operational damage. While the CVSS score varies between 7.3 and 8.1, the ability for an unauthenticated user to achieve full administrative control necessitates immediate attention.

Immediate Action: Update the Ultimate Member plugin to version 2.13.0 or later immediately to resolve the validation flaw.

Proactive Monitoring: Review user registration logs for suspicious account creations, specifically monitoring for new users assigned administrative roles or unusual account activity originating from unknown sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious registration requests, and temporarily disable self-registration features on the site if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the severity of this vulnerability, administrators should prioritize updating the Ultimate Member plugin to version 2.13.0 without delay. Failure to address this flaw leaves the application susceptible to full administrative takeover by any external actor capable of reaching the registration endpoint. Implement the update and perform a subsequent audit of existing user accounts to ensure no unauthorized administrative privileges have been granted.