CVE-2022-0885: vulnerability in Member Hero
Member Hero <= 1.0.9 - Unauthenticated RCE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 9.4%
from disclosure to weapon
Published on NVDJun 13
VulnCheck+829d
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
Affected products
Unknown · Member Hero