Unauthorized Data Modification in WCFM Membership Plugin for WordPress
CVE-2022-4940
7.3HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 5 April 2023
What is CVE-2022-4940?
The WCFM Membership plugin for WordPress suffers from a serious authorization bypass vulnerability that allows unauthenticated attackers to perform unauthorized actions. Due to insufficient capability checks on various AJAX actions, attackers can modify membership details, alter renewal information, and manipulate membership approvals among other critical operations, thereby compromising the integrity and security of the application and its users.
Affected Version(s)
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace * <= 2.10.0