CyberRota Analysis
AI-GeneratedThe Ultimate Member WordPress plugin prior to version 2.12.1 is vulnerable due to improper filtering of administrator-level capabilities in its registration forms, allowing unauthenticated users to register as administrators if such roles are available. This flaw can lead to unauthorized administrative access, posing a significant security risk to affected WordPress sites. Site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.