PT-2025-9164 · WordPress · Setsail Membership

Tonn

·

Publicado

2025-03-01

·

Atualizado

2025-03-07

·

CVE-2025-1564

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SetSail Membership plugin for WordPress versions up to, and including, 1.0.3
Description The issue arises from the plugin's failure to properly verify a user's identity through social login, allowing unauthenticated attackers to log in as any user, including administrators, and take over access to their account.
Recommendations For versions up to, and including, 1.0.3, update to a version higher than 1.0.3 to resolve the issue. As a temporary workaround, consider disabling the social login feature until a patch is available. Restrict access to sensitive areas of the WordPress dashboard to minimize the risk of exploitation.

Correção

Authentication Bypass Using an Alternate Path or Channel

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-1564

Produtos afetados

Setsail Membership