Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, 13ebeb485fc77c5a047ee7b6e21be5511d3131c3

CVE, Research URL: 13ebeb485fc77c5a047ee7b6e21be5511d3131c3
Home page URL: Security reports for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Application: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Published on: Sep 09, 2023
Research Description: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] < 4.13.2 ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles' The ProfilePress plugin for WordPress is vulnerable to limited privilege escalation in versions up to, and including, 4.13.1 via the 'acceptable_defined_roles' function due to incomplete validation on a user controlled key. This can allow unauthenticated attackers to elevate their privileges to a non-administrator role during user-registration.
Affected versions: max 4.13.2.
Status: vulnerable

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile &amp; Restrict Content – ProfilePress, 13ebeb485fc77c5a047ee7b6e21be5511d3131c3