Unauthorized Settings Update in WP-Members Plugin for WordPress

CVE-2023-2869

Summary

The WP-Members Membership plugin for WordPress is exposed to a vulnerability that permits authenticated attackers, with subscriber-level access, to manipulate and reorder form elements on login forms. This occurs due to a lack of necessary capability checks in the do_field_reorder function. Versions up to and including 3.4.7.3 are affected, making it imperative for users to update their installations to mitigate potential misuse.

References