Membership Simplified For Oap Members Only Vulnerabilities

[en] Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.

Affected:

up to 1.58

Fixed in:

1.58

Disclosed:

Sep 14, 2017

CVE-2017-1002010 on NVD →

[en] Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.

Affected:

up to 1.58

Fix:

No patched version reported

Disclosed:

Sep 14, 2017

CVE-2017-1002008 on NVD →

[en] Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.

Affected:

up to 1.58

Fixed in:

1.58

Disclosed:

Sep 14, 2017

CVE-2017-1002009 on NVD →

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.

CVSS:

9.8

Affected:

up to 1.58

Fix:

No patched version reported

Disclosed:

Mar 17, 2017

CVE-2017-1002009 on NVD →

Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.

CVSS:

8.8

Affected:

up to 1.58

Fixed in:

1.58

Disclosed:

Mar 17, 2017

CVE-2017-1002010 on NVD →

Arbitrary file download vulnerability found in WordPress Plugin Membership Simplified (version 1.58). Plugin does't check whether the user is logged in or not and if logged does it has file download privileges. We were unable to find patched version of this plugin. Also, this plugin removed from WordPress plugin reposi...

Affected:

up to 1.59

Fixed in:

1.59

Disclosed:

Mar 15, 2017

Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.

CVSS:

9.8

Affected:

up to 1.58

Fix:

No patched version reported

Disclosed:

Mar 13, 2017

CVE-2017-1002008 on NVD →