CVE-2022-0885: Memberhero Member Hero

Critical severity, CVSS 9.8. EPSS: 9.4% chance of exploitation in the next 30 days.

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.

Affected products

• Memberhero Member Hero: up to and including 1.0.9

Published 2022-06-13. Last modified 2026-06-17.