Simple Membership Plugin For WordPress < 4.3.5 Multiple Vulnerabilities

The WordPress Simple Member Plugin installed on the remote host is affected by multiple vulnerabilities as follows.

• A Account Takeover Vulnerability due to missing input validation on the process_password_reset_using_link function which permits authenticated attackers to gain access to arbitrary accounts on the instance. (CVE-2023-41956)

• A Privilege escalation due to missing input validation on the create_swpm_user function during the registration process. (CVE-2023-41957)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.