CVE-2023-6855mediumCWE-862

CVE-2023-6855: falha de média gravidade em strangerstudios Paid Memberships Pro – Content…

Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmpro_rest_api_get_permissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
strangerstudios · Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
CVEs relacionadas — strangerstudios Paid Memberships Pro – Content…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6187HIGHPaid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 51.3%CVE-2024-0624MEDIUMPaid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders UpdateEPSS 1.0%CVE-2024-0588MEDIUMPaid Memberships Pro <= 2.12.10 - Cross-Site Request ForgeryEPSS 0.9%CVE-2020-36754MEDIUMPaid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2024-3215MEDIUMPaid Memberships Pro <= 3.0.1 - Cross-Site Request ForgeryEPSS 0.3%CVE-2026-15016MEDIUMPaid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%