The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying settings and viewing sensitive data.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Indeed Membership Pro Plugin | — | Update indeed-membership-pro plugin to version 8.6.1, or a newer patched version | May 15, 2025 | Feb 6, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub