plugin
29 known security issues reported for the Indeed Membership Pro WordPress plugin. Most recent disclosed Mar 23, 2026.
Running Indeed Membership Pro on your site? Check whether your installed version is affected.
Scan your site freeThe Indeed Membership Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 13.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
[en] The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying se...
[en] Improper Privilege Management vulnerability in azzaroco Ultimate Membership Pro allows Privilege Escalation.This issue affects Ultimate Membership Pro: from n/a through 12.6.
[en] Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro allows Object Injection.This issue affects Ultimate Membership Pro: from n/a through 12.6.
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azzaroco Ultimate Membership Pro allows Reflected XSS.This issue affects Ultimate Membership Pro: from n/a through 12.6.
The Indeed Membership Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 12.7. This is due to the plugin not properly restricting access to functionality that allows privilege assignment. This makes it possible for unauthenticated attackers to gain access to accounts th...
The Indeed Membership Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 12.7 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is...
The Indeed Membership Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 12.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success...
The Ultimate Membership Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to create, modify, or delete user accounts, including acco...
The Ultimate Membership Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.6.1. This is due to missing or incorrect nonce validation on various AJAX functions. This makes it possible for unauthenticated attackers to perform a variety of tasks, such as deleting users...
Multiple Cross-Site Scripting (CSRF) vulnerabilities discovered ErwanLR in WordPress Ultimate Membership Pro premium plugin (versions <= 8.6.1).
Cross-Site Request Forgery (CSRF) vulnerability discovered by ErwanLR in WordPress Ultimate Membership Pro premium plugin (versions <= 8.6).
The Ultimate Membership Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to create, modify, or delete user accounts, including acco...
The Ultimate Membership Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.6.1. This is due to missing or incorrect nonce validation on various AJAX functions. This makes it possible for unauthenticated attackers to perform a variety of tasks, such as deleting users...
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying setting...
Multiple Critical Vulnerabilities found by Noman Riffat in Ultimate Membership Pro plugin (versions <= 8.6).
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying setting...
The Indeed Membership Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax-upload.php endpoint in versions up to, and including, 7.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make rem...
The Indeed Membership Pro plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 7.5 via the imgUrl feature. This allows unauthorized attackers to include remote files on the server, resulting in code execution.
The Indeed Membership Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax-upload.php endpoint in versions up to, and including, 7.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make rem...
The Indeed Membership Pro plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 7.5 via the imgUrl feature. This allows unauthorized attackers to include remote files on the server, resulting in code execution.
In addition to cropping/rotating/resizing an image of your choosing, you can abuse the imgUrl feature on versions that it's available on (7.4.2+ at least) to make an HTTP request to any site you want. For example, by having it connect to a site you control, you can determine the IP address of the origin even when...
The ajax-upload.php endpoint doesn't check for the current user's capabilities (or that they are even logged in), so we can do a few things we shouldn't be able to do: Without any credentials, you can simply POST the image file in the field ihc_file and it'll store it for you: ~$ curl -F "...
Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated (using a low privilege account, such as subscriber) Remote Code Execution on default Installation, as well as PII disclosure (such as emails, IP addresses, hashed passwords, usernames, User-Agent and so on), due to lack of a...
While confirming the issues from https://wpvulndb.com/vulnerabilities/10086 have been remediated, two CSRF issues were identified, allowing attackers to make logged in administrator delete arbitrary accounts, as well as create a new administrator account. Other CSRF may be present but haven't been checked. Fe...
Version 8.6.1 attempted fo fix multiple critical issues (mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses). However, the fixes were not sufficient: - An indeedIsAdmin() check was added to all AJAX calls for auth...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free