CVE-2015-4038: Wpmembership

Medium severity, CVSS 6.5. EPSS: 8.3% chance of exploitation in the next 30 days.

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an iv_membership_update_user_settings action to wp-admin/admin-ajax.php.

Affected products

• Wpmembership Wpmembership: version 1.2.3 only

Published 2015-06-03. Last modified 2026-06-17.