CVE-2022-4940 WCFM Membership <= 2.10.0 - Missing Authorization
Unauthenticated attackers can modify membership details and control approvals due to missing capability checks in the WCFM Membership plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4940?
CVE-2022-4940 is a high-severity missing authorization vulnerability in wclovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace, published on 5 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
Weakness: CWE-862
Which versions are affected by CVE-2022-4940?
It affects 1 product.
Products include Wclovers Wcfm Membership.
How do I fix CVE-2022-4940?
No fix has been published for CVE-2022-4940 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-4940 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4940 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in wclovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
Sources
Also known as GHSA-7f48-x47w-f5p2.