Description
WordPress Plugin WCFM Membership-WooCommerce Memberships for Multivendor Marketplace is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to change user passwords and potentially take over administrator accounts. WordPress Plugin WCFM Membership-WooCommerce Memberships for Multivendor Marketplace version 2.10.7 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.11.0 or latest
References
https://lana.codes/lanavdb/3a841453-d083-4f97-a7f1-b398c7304284/
https://plugins.svn.wordpress.org/wc-multivendor-membership/trunk/readme.txt
Related Vulnerabilities
Joomla! Core 3.x.x Cross-Site Scripting (3.7.0 - 3.10.6)
Jenkins Improper Input Validation Vulnerability (CVE-2015-1808)
Apache Traffic Server Improper Input Validation Vulnerability (CVE-2022-25763)
PHP Other Vulnerability (CVE-2002-0121)
phpMyFAQ Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-6048)