Tonda Membership
Monthly
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.