CVE-2022-4936

The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying shipping...

CVE-2022-4935

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

Design/Logic Flaw

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

Design/Logic Flaw

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

CVE-2022-4941 WCFM Membership <= 2.9.10 - Cross-Site Request Forgery

The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership...

CVE-2022-4941

CVE-2022-4941 affects the WCFM Membership plugin for WordPress (up to version 2.9.10). The underlying issue is a Cross-Site Request Forgery vulnerability caused by missing nonce checks on various AJAX actions, enabling unauthenticated attackers to trigger actions such as modifying membership deta...

CVE-2022-4941 WCFM Membership <= 2.9.10 - Cross-Site Request Forgery

The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership...

CVE-2022-4940 WCFM Membership <= 2.10.0 - Missing Authorization

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

CVE-2022-4940 WCFM Membership <= 2.10.0 - Missing Authorization

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

CVE-2022-4940

CVE-2022-4940 affects the WordPress plugin WCFM Membership (WordPress/WCFM Membership plugin) up to version 2.10.0. The root cause is missing capability checks on several AJAX actions (wcfm-memberships, wcfm-memberships-manage, wcfm-memberships-settings), leading to broken access control and allo...

CVE-2022-4939

CVE-2022-4939 affects the WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress. A missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings allows unauthenticated users to modify the membership registrat...

CVE-2022-4939 WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation

THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wpajaxnoprivwcfmajaxcontroller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to...

CVE-2022-4938 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery

The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying...

CVE-2022-4938 WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery

The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying...

CVE-2022-4938

CVE-2022-4938 (WCFM Frontend Manager for WordPress) : The vulnerability is a Cross-Site Request Forgery (CSRF) in versions up to and including 6.6.0. It arises from missing nonce checks on numerous AJAX actions, enabling unauthenticated attackers to induce a site administrator to perform actions ...

CVE-2022-4937

CVE-2022-4937 affects the WCFM Frontend Manager plugin for WordPress. The root cause is missing capability checks on numerous AJAX actions, enabling authenticated users with minimal privileges (e.g., subscribers) to modify data across knowledge bases, notices, payments, vendors, and more. The iss...

CVE-2022-4937

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

CVE-2022-4936 WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery

The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying shipping...

CVE-2022-4936 WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery

The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying shipping...

CVE-2022-4936

The CVE-2022-4936 entry concerns the WCFM Marketplace plugin for WordPress. Concrete details from connected sources show CSRF in versions up to 3.4.11/3.4.12 due to missing nonce checks on various AJAX actions, enabling unauthenticated attackers to trigger actions by deceiving an admin (e.g., mod...