CVE-2022-0885 Member Hero <= 1.0.9 - Unauthenticated RCE
Unauthenticated attackers can execute arbitrary PHP code via an AJAX action due to missing authorization and input validation in the Member Hero plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0885?
CVE-2022-0885 is a critical code injection vulnerability in Unknown Member Hero, published on 13 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
Which versions are affected by CVE-2022-0885?
It affects 1 product.
Products include Memberhero Member Hero.
How do I fix CVE-2022-0885?
No fix has been published for CVE-2022-0885 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-0885 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0885 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-vf8c-vc24-r3v4.