2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress","vendor":"properfraction","versions":[{"lessThanOrEqual":"4.16.11","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action."},{"lang":"es","value":"El plugin Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress para WordPress es vulnerable a una elusión de pago de membresía no autorizada en todas las versiones hasta la 4.16.11, inclusive. Esto se debe a una verificación de propiedad faltante en el parámetro 'change_plan_sub_id' en la función 'process_checkout()'. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, hagan referencia a la suscripción activa de otro usuario durante el proceso de pago para manipular los cálculos de prorrateo, lo que les permite obtener planes de membresía de por vida pagados sin pago a través de la acción AJAX 'ppress_process_checkout'."}],"id":"CVE-2026-3445","lastModified":"2026-07-21T19:10:00.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-06T17:51:27.565573Z","version":"2.0.3"}}]},"published":"2026-04-04T09:16:20.330","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3474509%40wp-user-avatar%2Ftrunk&old=3473639%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=#file3"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1e198b-0c0d-47aa-8a56-ec4e790c8022?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}
|