CVE-2023-2869 MEDIUM

CVE-2023-2869: WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

Vendor Cbutlerjr
Product WP-Members Membership Plugin
Weakness CWE-862 · Missing authorization
Published July 12, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.

Key dates

02Disclosure timeline

July 12, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-47619 WordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability CVE-2025-49431 WordPress MF Plus WPML plugin <= 1.1 - Settings Change Vulnerability CVE-2024-5993 Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update CVE-2025-14427 Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update CVE-2026-4064