Member Hero <= 1.0.9 - Unauthenticated RCE
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 9.3%
from disclosure to weapon
Published on NVDJun 13
VulnCheck+829d
exploitation probability
9.3%top 5% of all CVEs
observed exploitation
yesVulnCheck
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
Affected products
Unknown · Member Hero