Extension WordPress
Vulnérabilités WP Membership
Cette page rassemble les failles publiées pour WP Membership, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Membership
7 fiches
Membership <= 1.6.4 – Missing Authorization
The Membership plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
*-1.6.4
Non indiqué
22/01/2026
Membership <= 1.6.4 – Authenticated (Subscriber+) Privilege Escalation
The WP Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of…
*-1.6.4
Non indiqué
22/01/2026
WP Membership <= 1.6.3 – Missing Authorization to Authenticated (Subscriber+) Settings Update
The WP Membership plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access…
*-1.6.3
1.6.4
14/08/2025
WP Membership <= 1.6.2 – Unauthenticated Arbitrary File Upload
The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to…
*-1.6.2
1.6.3
08/11/2024
Multiple E-plugins (Various Versions) – Authenticated (Subscriber+) Privilege Escalation
Multiple plugins by the vendor E-plugins are vulnerable to privilege escalation due to insufficient restriction on several functions called via AJAX actions that set a user's role based on supplied role information. This makes it possible authenticated, subscriber-level…
[*, 1.5.7)
1.5.7
06/03/2023
WP Membership <= 1.2.3 – Privilege Escalation
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.
*-1.2.3
Non indiqué
21/05/2015
WP Membership <= 1.2.3 – Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be…
*-1.2.3
Non indiqué
21/05/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.