Authorization Bypass Vulnerability in Indeed's Membership Pro Plugin for WordPress

CVE-2020-36833

Summary

The Indeed Membership Pro plugin for WordPress contains a vulnerability that arises from missing capability checks on various AJAX actions. This allows authenticated users, even those with minimal permissions such as subscribers, to execute unauthorized actions. Users may manipulate settings and access sensitive information without the requisite permissions. This exposes sites using the affected plugin to significant security risks, emphasizing the importance of maintaining updated versions and implementing appropriate security measures.

References