Wcfm Membership vulnerabilities

3 known vulnerabilities in Wcfm Membership from Wclovers. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  WCFM Membership – WooCommerce Memberships for…: Authorization Bypass Through User-Controlled Key

  CVE-2023-2276May 20, 2023WcloversEPSS 1.09%

  The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, l

• 8.8 High severity

  WCFM Membership – WooCommerce Memberships for…: Cross-Site Request Forgery

  CVE-2022-4941Apr 5, 2023Wclovers

  The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of

• 9.8 Critical severity

  WCFM Membership – WooCommerce Memberships for…: Missing Authorization

  CVE-2022-4939Apr 5, 2023WcloversEPSS 2.1%

  THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it po