CVE-2022-4939
Published: 05 April 2023
Summary
CVE-2022-4939 is a critical-severity Missing Authorization (CWE-862) vulnerability in Wclovers Wcfm Membership. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The WCFM Membership plugin for WordPress is affected by a privilege-escalation vulnerability in versions up to and including 2.10.0. The root cause is a missing capability check on the unauthenticated wp_ajax_nopriv_wcfm_ajax_controller AJAX action that manages membership settings, allowing an attacker to alter the registration form so that newly created accounts receive arbitrary roles, including administrator.
An unauthenticated remote attacker can exploit the flaw by first modifying the membership registration configuration to assign the administrator role, then completing the registration process to obtain an account with full administrative privileges on the WordPress site. The vulnerability carries a CVSS 3.1 base score of 9.8.
Public references point to a patched changeset published in the WordPress plugin repository and to detailed analysis from Wordfence that confirm the issue was resolved after version 2.10.0; site owners are advised to update the plugin immediately. The EPSS score has remained at 0.2032 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-52193
Vulnerability details
THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers…
more
to modify the membership registration form in a way that allows them to set the role for registration to that of any user including administrators. Once configured, the attacker can then register as an administrator.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.