Authorization Bypass Vulnerability in Indeed's Membership Pro Plugin for WordPress

CVE-2020-36833

What is CVE-2020-36833?

The Indeed Membership Pro plugin for WordPress contains a vulnerability that arises from missing capability checks on various AJAX actions. This allows authenticated users, even those with minimal permissions such as subscribers, to execute unauthorized actions. Users may manipulate settings and access sensitive information without the requisite permissions. This exposes sites using the affected plugin to significant security risks, emphasizing the importance of maintaining updated versions and implementing appropriate security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References