Authorization Bypass Vulnerability in Indeed's Membership Pro Plugin for WordPress

CVE-2020-36833
6.3MEDIUM

Key Information

Vendor
WPindeed
Status
Indeed Membership Pro
Vendor
CVE Published:
16 October 2024

Summary

The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying settings and viewing sensitive data.

Affected Version(s)

Indeed Membership Pro <= 8.6

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

  • Disclosed

Collectors

NVD DatabaseMitre Database

Credit

Norman Riffat
.