PT-2015-6395
CVE-2015-4038
·
تاريخ النشر
2015-06-03
·
تاريخ التحديث
2018-10-09
الوصف من
CVSS 2.0
6.5
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
WP Membership plugin version 1.2.3
Description
The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an
iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint.Recommendations
For WP Membership plugin version 1.2.3, consider disabling the
iv membership update user settings action until a patch is available. Restrict access to the "wp-admin/admin-ajax.php" endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾