PT-2015-6395
CVE-2015-4038
·
Publicado
2015-06-03
·
Atualizado
2018-10-09
Descrição por
CVSS 2.0
6.5
MédiaMétricasAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
WP Membership plugin version 1.2.3
Description
The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an
iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint.Recommendations
For WP Membership plugin version 1.2.3, consider disabling the
iv membership update user settings action until a patch is available. Restrict access to the "wp-admin/admin-ajax.php" endpoint to minimize the risk of exploitation.Explorabilidade
Exploit
Correção
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾