WCFM Membership – WooCommerce Memberships for Multivendor Marketplace, CVE-2022-4939
- CVE, Research URL
- Home page URL
-
Security reports for WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
- Published on
- Apr 06, 2023
- Research Description
- THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way that allows them to set the role for registration to that of any user including administrators. Once configured, the attacker can then register as an administrator.
- Affected versions
-
max 2.10.1.
- Status
-
vulnerable