CVE-2023-6855

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6855
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6855.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6855
Published
2024-01-11T08:32:31.855Z
Modified
2026-07-15T01:49:15.647963077Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Paid Memberships Pro <= 2.12.5 - Missing Authorization via API
Details

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6855.json",
    "cna_assigner": "Wordfence",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "2.12.5"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/strangerstudios/paid-memberships-pro

Affected ranges

Type
GIT
Repo
https://github.com/strangerstudios/paid-memberships-pro
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6c2ea641f8580f438090ebf7c91d7cadf81dae85
Database specific 
{
    "cpe": "cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.12.5"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*
2.10
2.10-RC1
2.10-RC2
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11
2.11.1
2.11.2
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.6
2.6.1
2.6.1.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8
2.8.1
2.8.2
2.8.3
2.9.1
2.9.2
2.9.3
2.9.4
archive/v1.*
archive/v1.9.4
release-1.*
release-1.8
release-1.8.1
release-1.8.10.1
release-1.8.10.2
release-1.8.10.3
release-1.8.10.4
release-1.8.11
release-1.8.11.1
release-1.8.11.2
release-1.8.12
release-1.8.12.1
release-1.8.13
release-1.8.13.1
release-1.8.13.2
release-1.8.13.3
release-1.8.13.4
release-1.8.13.5
release-1.8.13.6
release-1.8.2
release-1.8.2.2
release-1.8.3
release-1.8.4
release-1.8.4.2
release-1.8.4.3
release-1.8.4.5
release-1.8.6.6
release-1.8.6.7
release-1.8.6.8
release-1.8.7
release-1.8.7.3
release-1.8.8
release-1.8.8.1
release-1.8.8.3
release-1.8.9
release-1.8.9.1
release-1.9
release-1.9.1
release-1.9.2
release-1.9.2.1
release-1.9.3
release-1.9.4
release-1.9.4.1
release-1.9.4.2
release-1.9.4.3
release-1.9.4.4
release-v1.*
release-v1.8.2.1
v1.*
v1.7.5
v2.*
v2.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.7
v2.2
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.3
v2.3.4
v2.4
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5
v2.5.1
v2.5.2
v2.5.4
v2.5.5
v2.5.6
v2.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6855.json"