Cross-Site Request Forgery in WCFM Membership Plugin for WordPress

CVE-2022-4941

Summary

The WCFM Membership plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the lack of nonce checks on various AJAX actions. Specifically, this could enable attackers to manipulate membership details, alter renewal information, and influence membership approvals through crafted requests, provided they can deceive a site administrator into executing a malicious link. This issue affects versions up to and including 2.9.10, presenting a significant risk to the integrity and management of membership functionalities.

References