CVE-2022-0885: Member Hero <= 1.0.9 - Unauthenticated RCE

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account or user interaction is required.

Q: What capability does exploitation provide?

The vulnerable AJAX action allows an attacker to invoke arbitrary PHP functions that take no arguments, which can result in remote code execution.

Q: Which installations are affected?

Member Hero WordPress plugin versions through 1.0.9 are affected.

Published Jun 13, 2022

Updated

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.

Affected Software

1 affected component

Memberhero Member Hero Wordpress<=1.0.9

Event History

Jun 13, 2022

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account or user interaction is required.

What capability does exploitation provide?

The vulnerable AJAX action allows an attacker to invoke arbitrary PHP functions that take no arguments, which can result in remote code execution.

Which installations are affected?

Member Hero WordPress plugin versions through 1.0.9 are affected.

CVE-2022-0885: Member Hero <= 1.0.9 - Unauthenticated RCE

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation provide?

Which installations are affected?