CVE-2024-7493: 
WordPress vulnerability analysis and mitigation

The WPCOM Member plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2024-7493) affecting all versions up to and including 1.5.2.1. The vulnerability was discovered and reported by Wordfence, with initial disclosure on September 6, 2024 (NVD Database).

The vulnerability stems from the plugin's improper handling of user registration data, specifically allowing arbitrary data to be passed to the wp_insert_user() function during the registration process. This implementation flaw has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a highly severe security issue (NVD Database).

The vulnerability allows unauthenticated attackers to escalate their privileges to administrator level during the registration process. This means that any user registering on an affected site could potentially gain full administrative access to the WordPress installation (NVD Database).

The vulnerability is particularly concerning as it requires no authentication and can be exploited during the standard user registration process. The attack vector is network-accessible and requires low complexity to execute, making it highly exploitable (NVD Database).

Site administrators running affected versions of the WPCOM Member plugin should immediately update to version 1.5.3 or later, which contains the security fix for this vulnerability (NVD Database).