WordPress Plugin Vulnerabilities

WCFM Membership < 2.11.0 - Unauthenticated Arbitrary Password Update via IDOR

Description

The plugin allows unauthenticated attackers to update the password of arbitrary account via an IDOR attack, which could allow them to gain access to high privilege ones such as administrator

Affects Plugins

Plugin icon
wc-multivendor-membership
Fixed in 2.11.0

References

CVE
CVE-2023-2276

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
b9ca4404-40a0-4f59-9327-dae19a753126

Timeline

Publicly Published
2023-05-03 (about 2 years ago)
Added
2023-05-20 (about 2 years ago)
Last Updated
2023-05-20 (about 2 years ago)

Other

Published
Title
Published
2025-07-21
Title
WP JobHunt <= 7.2 - Subscriber+ Arbitrary Account Deletion via IDOR
Published
2026-01-02
Title
Justicia <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-02-27
Title
WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR
Published
2026-01-09
Title
Rosebud <= 1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-06-23
Title
JS Help Desk - Best Help Desk & Support < 2.7.8 - Subscriber+ Ticket Manipulation via IDOR