PT-2023-15926 · WordPress · Wcfm Membership

Chloe Chamberland · CVE-2022-4940 · Publicado 2023-04-05 · Atualizado 2026-01-04

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WCFM Membership plugin for WordPress versions up to, and including, 2.10.0

Description The issue allows unauthorized modification and access of data due to missing capability checks on various AJAX actions. This enables unauthenticated attackers to perform actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.

Recommendations For versions up to, and including, 2.10.0, update to a version higher than 2.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions until a patch is available.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2022-4940

Produtos afetados

Wcfm Membership

Referências · 9

• https://wordfence.com/threat-intel/vulnerabilities/id/9c6577a2-6722-4d3b-958d-1143dca414cd?source=cve · Correção
• https://twitter.com/pdnuclei_bot/status/2007602927838564721 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633191%40wc-multivendor-membership&new=2633191%40wc-multivendor-membership&sfp_email=&sfph_mail= · Correção
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2605020%40wc-multivendor-membership&new=2605020%40wc-multivendor-membership&sfp_email=&sfph_mail= · Correção
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632641%40wc-multivendor-membership&new=2632641%40wc-multivendor-membership&sfp_email=&sfph_mail= · Correção
• https://osv.dev/vulnerability/CVE-2022-4940 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4940 · Nota de Segurança
• https://t.me/cibsecurity/61493 · Publicação no Telegram
• https://t.me/cvenotify/47639 · Publicação no Telegram