CVE-2022-0885

CRITICALNuclei

Member Hero <= 1.0.9 - Unauthenticated RCE

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0885 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Member Hero

Default status: affected

CVE ListThrough 1.0.9affected

member_hero

Browse memberhero / member_hero
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALMember Hero <=1.0.9 - Remote Code ExecutionCVSS 9.8

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

An attacker can execute arbitrary code on the target system, potentially leading to a complete compromise of the WordPress site.

Remediation

Update to the latest version of the Member Hero plugin (1.0.9 or higher) to mitigate this vulnerability.

WeaknessesCWE-862
Authorstheamanrawat
Template tagscvecve2022unauthwpscanwp-pluginrcewpwordpressmember-heromemberherovkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:memberhero:member_hero:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/8b08b72e-5584-4f25-ab73-5ab0f47412df https://wordpress.org/plugins/member-hero/ https://nvd.nist.gov/vuln/detail/CVE-2022-0885 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2