WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability
CVE-2023-41956

8.8HIGH

Key Information:

Vendor
WordPress
Status
Simple Membership
Vendor
CVE Published:
17 May 2024

Summary

The vulnerability involves improper authentication mechanisms within the Insider Simple Membership plugin, potentially allowing unauthorized users to gain access to sensitive account functionalities. Versions affected include those prior to 4.3.4, where insufficient validation could enable attackers to exploit this issue and perform actions on behalf of legitimate users. Users and administrators are advised to upgrade to the latest version to mitigate these risks effectively.

Affected Version(s)

Simple Membership <= 4.3.4

References

https://patchstack.com/database/vulnerability/simple-memb...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.