A security issue with the plugin | ww.wp.xz.cn

Resolved pratima726
(@pratima726)

6 years, 11 months ago

I found a security issue with the plugin that allows registering users to change the subscription plan and manually enter the subscription fees with a slight change in the url.

The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)

Thread Starter pratima726
(@pratima726)

6 years, 11 months ago

Using this plugin, we’ve provided member registration features with different subscription plans.
However, we noticed that the subscription plans, as well as the payment, could be altered with a quick change in the URL.

Plugin Author Georgian Cocora
(@raster02)

6 years, 11 months ago

Hello @pratima726,

You’re talking about this feature: https://www.cozmoslabs.com/docs/paid-member-subscriptions/shortcodes/#Pre-select_a_subscription_plan_through_an_URL_parameter ?

That’s how it’s supposed to work. There’s nothing locked in when you reach the form and there’s nothing stopping the user to press Back and just select another plan from your pricing table page (I suppose this is what you’re using).

Regards.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘A security issue with the plugin’ is closed to new replies.

2 replies
2 participants
Last reply from: Georgian Cocora
Last activity: 6 years, 11 months ago
Status: resolved