CVE-2023-2869 (published 2023-07-12T04:38:48.717Z)
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
Affected products: Vendor: cbutlerjr
Product: WP-Members Membership Plugin
Versions: *