Restrict User Access Membership Plugin With Force
Monthly
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.