Vulnerability CVE-2017-1002008
Published: 2017-09-14

Description:
Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.

See advisories in our WLB2 database:
Topic
Author
Date
High
Wordpress Plugin Membership Simplified v1.58 - Arbitrary File Download
Munir Njiru
16.03.2017
High
WordPress Membership Simplified 1.58 Arbitrary File Download
Larry W. Cashdol...
17.03.2017

Type:

CWE-23

 (Relative Path Traversal)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Membership-simplified-for-oap-members-only project -> Membership-simplified-for-oap-members-only 

 References:
http://www.vapidlabs.com/advisory.php?v=187
https://wordpress.org/plugins/membership-simplified-for-oap-members-only
https://wpvulndb.com/vulnerabilities/8777
https://www.exploit-db.com/exploits/41622/
Copyright 2024, cxsecurity.com

 

Back to Top