CVE-2023-2276

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
wcloversWCFM Membership – WooCommerce Memberships for Multivendor Marketplace<= 2.10.7

References

Timeline

Published
May 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-227607.2Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of theseCVE-2023-227617.2Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of theseCVE-2023-227627.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227637.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227647.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227657.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227667.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227677.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227687.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-227697.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieCVE-2023-22774.7The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due tCVE-2023-227707.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie
CVE-2023-2276: Critical severity, CVSS 9.8 | Vulnix