CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify other users' membership payments.
Explanation of Vulnerability in Simple Terms
WCFM Membership contains an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability affects versions up to 2.11.8 and requires a valid user account to exploit. Site administrators should update to a patched version to prevent unauthorized data modification by low-privileged users.
What an attacker can do
Modify data within the plugin that should be restricted to higher-privileged users.
Potential impact on your site
Unauthorized users could alter membership settings, vendor data, or other plugin configuration without proper authorization.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
