CVE-2022-2273

CWE-269 — Improper Privilege Management3 documents3 sources

Severity

8.8HIGH

EPSS

0.7%

top 28.49%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Simple Membership Simple-membership-plugin Simple Membership

Timeline

PublishedAug 1

Latest updateAug 2

Description

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDsimple-membership-plugin/simple_membership< 4.1.3

▶CVEListV5unknown/simple_membership4.1.3 — 4.1.3

🔴Vulnerability Details

GHSA

GHSA-hfj7-fhvx-37c9: The Simple Membership WordPress plugin before 4↗2022-08-02

▶

CVEList

Simple Membership < 4.1.3 - Membership Privilege Escalation↗2022-08-01

▶