Critical WordPress Plugin Vulnerability Exploited in Active Attacks A severe security flaw in the User Registration & Membership WordPress plugin installed on over 60,000 websites is being actively exploited by cybercriminals, granting unauthorized access to vulnerable sites. The vulnerability allows attackers to bypass authentication protocols, enabling full control over affected installations. Attackers are leveraging the flaw by crafting malicious payloads that manipulate the plugin’s core functions, evading standard security measures. Observed exploitation methods include: - Bypassing user authentication checks - Deploying targeted payloads - Circumventing security defenses The consequences of unpatched systems are severe, including data breaches, website defacement, and ransomware deployment, posing risks to both site owners and end users. The plugin’s developers have released a patch to address the issue, but delayed updates leave sites exposed. Administrators are urged to immediately update the plugin to the latest version and implement additional security measures, such as monitoring for suspicious activity and conducting regular audits. The incident underscores the ongoing risks of unpatched third-party plugins in WordPress ecosystems.