CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Explanation of Vulnerability in Simple Terms
The WP-Members Membership Plugin for WordPress contains a code injection vulnerability in versions up to 3.5.4.2. An authenticated user with low privileges can inject and execute arbitrary PHP code on the site under certain conditions. The vulnerability requires specific attack complexity but can compromise site confidentiality, integrity, and availability.
What an attacker can do
Inject and execute arbitrary PHP code on the WordPress site.
Potential impact on your site
Compromised site integrity, data exposure, and potential service disruption if exploited.
Conditions required to exploit
Attacker must be authenticated with low-level user privileges; specific technical conditions must be met.
Key dates
External resources
Related vulnerabilities
