Critical WordPress Plugin Flaw Lets Attackers Bypass Authentication and Gain Admin Access

Critical Vulnerability in WordPress Plugin Allows Attackers to Bypass Authentication

A critical vulnerability has been identified in the User Role Editor plugin for WordPress, which allows attackers to bypass authentication and gain administrative access. This flaw affects versions 12.3 through 14.8 of the plugin.

Overview of the Vulnerability

The issue lies within a specific endpoint /wp-admin/admin-ajax.php that handles AJAX requests related to user role assignments. Attackers can exploit this by manipulating certain parameters in these requests, leading to unauthorized privilege escalation and full administrative control over the WordPress site.

Technical Details

• Vulnerable Versions: 12.3 - 14.8
• Endpoint Exploited: /wp-admin/admin-ajax.php
• Parameter Manipulation: Attackers can manipulate parameters related to role assignments, bypassing authentication checks and gaining admin privileges.

Impact

This vulnerability could allow attackers to:

• Gain full administrative access without needing valid login credentials.
• Modify site configurations, add malicious content, or steal sensitive data.

Mitigation Steps

1. Update the Plugin:
   • Immediately update the User Role Editor plugin to version 14.9 or later, which

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.