The Tiare Membership plugin for WordPress contains a flaw that allows an unauthenticated user to assign the administrator role during the registration process. The vulnerability arises from the ‘tiare_membership_init_rest_api_register’ function failing to restrict which user roles may be registered. As a result, an attacker can obtain full administrative control of the WordPress site, compromising confidentiality, integrity, and availability of all site data and functions.

The bug affects all releases of the Tiare Membership plugin up to and including version 1.2, distributed by Qode Interactive. The impacted systems are WordPress installations that have the vulnerable plugin installed and active, regardless of site size or owner.

The CVSS score of 9.8 reflects a severe vulnerability that can be exploited remotely with no authentication. The EPSS score of less than 1% indicates that while exploitation is technically possible, it is unlikely to be widely seen in the wild; nevertheless the potential impact is catastrophic. The vulnerability is not listed in the CISA KEV catalog, but the risk remains high because unauthenticated attackers can elevate to administrator without any additional privileges. The likely attack vector is a simple POST request to the registration endpoint, supplied with a payload that sets the role field to administrator.