CVE-2014-3849

Currently unrated

Key Information:

Vendor
Wordpress
Status
Imember360
Vendor
CVE Published:
23 May 2014

Summary

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.

References

http://packetstormsecurity.com/files/126324/WordPress-iMe...
x_refsource_MISC
http://www.exploit-db.com/exploits/33076
exploitx_refsource_EXPLOIT-DB
http://www.osvdb.org/106300
vdb-entryx_refsource_OSVDB

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.