CVE-2014-3849

2022-10-0316:20:25

mitre

www.cve.org

wordpress

imember360 plugin

remote attackers

user deletion

6.8 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.5%

JSON

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.