Horizon Alert
Summary of the vulnerability and why it matters
This security advisory concerns a critical vulnerability in the Wishlist Member plugin for WordPress, which could allow unauthorized individuals to take over any WordPress account, including administrator accounts. The issue stems from insufficient verification of data authenticity during user registration, potentially enabling attackers to alter account details and compromise system access without requiring authentication. The main concern is confirming relevance and exposure.
- Unauthenticated users can take over WordPress accounts.
- Critical vulnerability impacts account security and site administration.
- Assess plugin use and confirm exposure to prevent account takeover.
Attack Path
How an attacker could exploit the issue
Attackers can exploit an unauthenticated vulnerability in the Wishlist Member WordPress plugin to take over any user account. This is achieved by manipulating registration parameters to overwrite account details, including passwords and email addresses, while suppressing notification emails. The vulnerability can also lead to privilege escalation, granting attackers administrative access.
- No authentication required for attack.
- Manipulates registration to overwrite account data.
- Full account takeover and privilege escalation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to take over any existing WordPress account, including administrator accounts. The attacker could change the target account's username, password, email address, first name, and last name, while preventing WordPress from sending notification emails about these changes. When the attacker targets an account with administrator privileges, they could achieve full privilege escalation.
- Asset at risk: WordPress user accounts, including administrators.
- How exposure could happen: Unauthenticated attackers submitting crafted requests.
- Realistic consequence: Complete account takeover and privilege escalation.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects the Wishlist Member plugin for WordPress, making it a concern for teams managing WordPress sites, including application owners and potentially infrastructure or platform teams responsible for the WordPress deployment. The first practical step is to identify all WordPress instances using this plugin, determine their exposure (especially public-facing sites), and ascertain the accountable owner for each instance before planning remediation.
- WordPress site owners are responsible.
- Verify all public-facing WordPress installations.
- Plan coordinated updates or mitigation.
