CVE-2024-43242

2024-08-1918:15:10

CWE-502

[email protected]

web.nvd.nist.gov

cve-2024-43242

untrusted data

object injection

ultimate membership pro

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

31.6%

JSON

Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro allows Object Injection.This issue affects Ultimate Membership Pro: from n/a through 12.6.

Affected configurations

Nvd

Node

wpindeedultimate_membership_proRange≤12.6wordpress

VendorProductVersionCPE
wpindeedultimate_membership_pro*cpe:2.3:a:wpindeed:ultimate_membership_pro:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpindeed	ultimate_membership_pro	*	cpe:2.3:a:wpindeed:ultimate_membership_pro::::::wordpress::*

References

patchstack.com/database/vulnerability/indeed-membership-pro/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-php-object-injection-vulnerability?_s_id=cve