CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.
Explanation of Vulnerability in Simple Terms
The Membership For WooCommerce plugin for WordPress does not properly check user permissions before allowing access to sensitive membership data. An unauthenticated attacker can read membership information, user details, and subscription records without logging in. This affects all versions up to 2.8.1. Site owners should update immediately to a patched version.
What an attacker can do
Read membership data, user details, and subscription records without authentication.
Potential impact on your site
Membership and subscription data exposed to anyone on the internet; customer privacy and business logic compromised.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
