Threats tagged 'ghsa-qgvv-r5pp-fcw2'

The RealHomes Memberships WordPress plugin versions before 3.1.0 contain a vulnerability where the plugin does not verify that a membership payment has actually completed, nor does it check a nonce or the user's capability before granting paid membership packages. This allows any authenticated user, including those with low privileges such as Subscribers, to obtain paid membership packages without payment.