Wclovers Wcfm Membership vulnerabilities

CVE-2022-4940 [MEDIUM] CWE-862 CVE-2022-4940: The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of da The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal inform

CVE-2022-4939 [CRITICAL] CWE-862 CVE-2022-4939: THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, an THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way th

CVE-2023-2276 [CRITICAL] CWE-639 CVE-2023-2276: The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vu The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for

CVE-2022-4941 [HIGH] CWE-352 CVE-2022-4941: The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling members