CVE-2022-4940highexplotación observadaCWE-862

CVE-2022-4940: fallo de gravedad alta en wclovers WCFM Membership – WooCommerce…

WCFM Membership <= 2.10.0 - Missing Authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

58Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 7.3epss 1.1%
de la publicación al arma
Publicada en NVD5 abr
VulnCheck+1d
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
CVEs relacionadas — wclovers WCFM Membership – WooCommerce…

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-4939CRITICALWCFM Membership <= 2.10.0 - Unauthenticated Privilege EscalationEPSS 2.1%CVE-2023-2276CRITICALWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 1.1%CVE-2026-3688HIGHWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role OverwriteEPSS 0.4%CVE-2022-4941MEDIUMWCFM Membership <= 2.9.10 - Cross-Site Request ForgeryEPSS 0.3%CVE-2025-15147MEDIUMWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership PaymentEPSS 0.3%