← Database

CVE-2022-0885

CRITICAL CVSS: 9.8 Published: 2022-06-13 Modified: 2026-06-17

Description

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.

Affected Platforms

Memberhero Member Hero

Weakness Type

CWE-94, CWE-862

References