CVE-2023-2276
Assigner: Wordfence
Published: 2023-05-20T03:35:57.027Z
State: PUBLISHED
affected: vendor: wclovers
product: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
versions: version: *
status: affected
lessThanOrEqual: 2.10.7
versionType: semver
defaultStatus: unaffected
descriptions: value: The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
problemTypes: descriptions: description: CWE-639 Authorization Bypass Through User-Controlled Key
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
credits: type: finder
value: Lana Codes
timeline: time: 2023-04-24T00:00:00.000+00:00
value: Discovered
time: 2023-04-24T00:00:00.000+00:00
value: Vendor Notified
time: 2023-05-03T00:00:00.000+00:00
value: Disclosed