CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.
Explanation of Vulnerability in Simple Terms
Paid Memberships Pro versions up to 3.0.4 contain an authorization bypass vulnerability that allows unauthenticated attackers to modify membership data and settings. The vulnerability stems from insufficient access controls on critical administrative functions. An attacker can exploit this over the network without requiring user interaction, potentially compromising membership records and site configuration.
What an attacker can do
Modify membership data, settings, and user records without authentication.
Potential impact on your site
Membership records, pricing, and site settings can be altered by unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
