CVE-2022-4940highexploração observadaCWE-862

CVE-2022-4940: falha de alta gravidade em wclovers WCFM Membership – WooCommerce…

WCFM Membership <= 2.10.0 - Missing Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

58Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 7.3epss 1.1%
da publicação à arma
Publicada no NVD5 de abr.
VulnCheck+1d
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
wclovers · WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
CVEs relacionadas — wclovers WCFM Membership – WooCommerce…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-4939CRITICALWCFM Membership <= 2.10.0 - Unauthenticated Privilege EscalationEPSS 2.1%CVE-2023-2276CRITICALWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 1.1%CVE-2026-3688HIGHWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role OverwriteEPSS 0.4%CVE-2022-4941MEDIUMWCFM Membership <= 2.9.10 - Cross-Site Request ForgeryEPSS 0.3%CVE-2025-15147MEDIUMWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership PaymentEPSS 0.3%