CVE-2024-2123: 
WordPress vulnerability analysis and mitigation

The Ultimate Member WordPress plugin (CVE-2024-2123) contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 2.8.3. The vulnerability was discovered on February 28th, 2024, during Wordfence's Bug Bounty Extravaganza and was publicly disclosed on March 8th, 2024. This security flaw affects over 200,000 active WordPress installations (GBHackers News, Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's member directory list functionality. Specifically, user display names are displayed unescaped in template files, allowing attackers to inject malicious scripts during registration as an unauthenticated user. The vulnerability has been assigned a CVSS v3.1 score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability enables attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. This can lead to various malicious activities, including the addition of administrative users, redirection to harmful sites, and injection of backdoors into theme and plugin files (GBHackers News).

The vulnerability is particularly severe as it can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector involves providing a malicious script within the display name during the registration process (Wordfence Advisory).

A patch was released on March 6th, 2024, in version 2.8.4 of the Ultimate Member plugin. Website administrators are strongly advised to update to this latest version. Wordfence customers, including those using Premium, Care, and Response services, as well as free version users, are protected through the Wordfence firewall's built-in XSS protection (GBHackers News).

The vulnerability was initially reported through Wordfence's Bug Bounty program, with the researcher 'stealthcopter' receiving a $563 bounty for the discovery. The security community has emphasized the importance of this fix given the plugin's large user base of over 200,000 active installations (Wordfence Advisory).