Vulnerabilities > CVE-2023-6733 - Missing Authorization vulnerability in Butlerblog Wp-Members

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

butlerblog

CWE-862

NVD

Published: 2024-01-04

Updated: 2024-11-21

Summary

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.

Vulnerable Configurations

Part	Description	Count
Application	Butlerblog Butlerblog WP Members - Butlerblog WP Members 3.1.7 Butlerblog WP Members 3.2.0 Butlerblog WP Members 3.2.1 Butlerblog WP Members 3.2.2 Butlerblog WP Members 3.2.3 Butlerblog WP Members 3.2.4 Butlerblog WP Members 3.2.5 Butlerblog WP Members 3.2.6 Butlerblog WP Members 3.2.7 Butlerblog WP Members 3.2.8 Butlerblog WP Members 3.2.9 Butlerblog WP Members 3.2.9.1 Butlerblog WP Members 3.2.9.2 Butlerblog WP Members 3.2.9.3 Butlerblog WP Members 3.3.0 Butlerblog WP Members 3.3.1 Butlerblog WP Members 3.3.2 Butlerblog WP Members 3.3.3 Butlerblog WP Members 3.3.4 Butlerblog WP Members 3.3.5 Butlerblog WP Members 3.3.6 Butlerblog WP Members 3.3.7 Butlerblog WP Members 3.3.8 Butlerblog WP Members 3.3.9 Butlerblog WP Members 3.4.0 Butlerblog WP Members 3.4.1 Butlerblog WP Members 3.4.2 Butlerblog WP Members 3.4.3 Butlerblog WP Members 3.4.4 Butlerblog WP Members 3.4.5 Butlerblog WP Members 3.4.6 Butlerblog WP Members 3.4.7	33

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References