Threat database

The Divi Membership WordPress plugin versions up to 2.2.0 contain a critical privilege escalation vulnerability. An unauthenticated attacker can exploit improper privilege management in the user registration process to create a new account with administrator privileges. This is achieved by submitting a specially crafted bcrypt hash of the 'administrator' role in the form_id POST parameter. The vulnerability requires a WordPress nonce, which is publicly available on pages rendering the registration form, allowing any visitor to exploit it and gain full site control.

Divi Membership plugin for WordPress versions up to 2.3.0 contains an authentication bypass vulnerability. The vulnerability arises from the process_paypal_callback function accepting a base64-encoded paypal_param GET parameter without proper validation or verification. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, by supplying an arbitrary user ID. The vulnerability leads to full site takeover. The PayPal gateway class is always instantiated, making the vulnerable code active on every front-end request.