What’s Vulnerable › Vulnerabilities

CVE-2024-12287: Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-18 · updated 2026-06-17
• Weakness: CWE-287

Description

The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, such as administrators, granted they have access to an email.

Affected products

• Mikado-Themes Biagiotti Membership: through 1.0.2

References

• https://themeforest.net/item/biagiotti-beauty-and-cosmetics-shop/24645919
• https://www.wordfence.com/threat-intel/vulnerabilities/id/12f319df-41eb-484a-8fca-af6ae76f4179?source=cve

Get alerted when CVE-2024-12287 or the next vulnerability affects your stack