WP-Members Membership Plugin, CVE-2023-2869

CVE, Research URL: CVE-2023-2869
Home page URL: Security reports for WP-Members Membership Plugin
Application: WP-Members Membership Plugin
Published on: Jul 12, 2023
Research Description: The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
Affected versions: Min -, max 2.8.10.
Status: vulnerable