CVE-2022-2273

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Unknown	Simple Membership	>= 4.1.3, < 4.1.3

References

https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84Exploit, Third Party Advisory
https://wpscan.com/vulnerability/724729d9-1c4a-485c-9c90-a27664c47c84Exploit, Third Party Advisory

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-227309.8Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to pote CVE-2022-227319.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow CVE-2022-227327.5A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supp CVE-2022-227336.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has g CVE-2022-227346.1The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and esca CVE-2022-227358.8The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lack CVE-2022-227367.0If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory CVE-2022-227377.5Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aft CVE-2022-227388.8Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially CVE-2022-227396.5Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affect CVE-2022-22749.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This is CVE-2022-227408.8Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causi