CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.9.0.
Explanation of Vulnerability in Simple Terms
The Membership For WooCommerce plugin for WordPress does not properly check user permissions before allowing access to sensitive membership data. An unauthenticated attacker can read membership information, user details, and subscription records without logging in. This affects all versions up to 2.9.0. Site owners should update immediately to a patched version.
What an attacker can do
Read membership data, user details, and subscription records without authentication.
Potential impact on your site
Membership and subscription data is exposed to anyone on the internet, including customer names, emails, and payment history.
Conditions required to exploit
None. The attacker needs only network access; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
