CVE-2024-43240

2024-08-1917:15:08

CWE-269

[email protected]

web.nvd.nist.gov

cve-2024-43240

improper privilege management

ultimate membership pro

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.7%

JSON

Improper Privilege Management vulnerability in azzaroco Ultimate Membership Pro allows Privilege Escalation.This issue affects Ultimate Membership Pro: from n/a through 12.6.

Affected configurations

Nvd

Node

wpindeedultimate_membership_proRange≤12.6wordpress

VendorProductVersionCPE
wpindeedultimate_membership_pro*cpe:2.3:a:wpindeed:ultimate_membership_pro:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpindeed	ultimate_membership_pro	*	cpe:2.3:a:wpindeed:ultimate_membership_pro::::::wordpress::*

References

patchstack.com/database/vulnerability/indeed-membership-pro/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-privilege-escalation-vulnerability?_s_id=cve