CVE-2022-0885
Published: 13 June 2022
Summary
CVE-2022-0885 is a critical-severity Code Injection (CWE-94) vulnerability in Memberhero Member Hero. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Member Hero WordPress plugin through version 1.0.9 contains an authorization bypass vulnerability tracked as CVE-2022-0885. The plugin fails to enforce access controls on an AJAX action and does not validate the supplied “a” request parameter, enabling unauthenticated callers to invoke arbitrary PHP functions without arguments. The flaw is reflected in CWEs 94 and 862 and carries a CVSS 3.1 base score of 9.8.
Unauthenticated attackers reachable over the network can exploit the issue to execute PHP functions on the hosting server. Successful abuse can result in disclosure, modification, or destruction of data and full control of the affected WordPress installation.
The current EPSS score of 0.7961, with a recorded peak of 0.8740, indicates sustained and substantial exploitation interest following disclosure. WPScan has published technical details of the vulnerability at the referenced advisory URLs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15921
Vulnerability details
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.