cve/2017/CVE-2017-1002008.md

### [CVE-2017-1002008](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1002008)
![](https://img.shields.io/static/v1?label=Product&message=membership-simplified-for-oap-members-only&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%201.58%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brighgreen)

### Description

Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.

### POC

#### Reference
- https://wpvulndb.com/vulnerabilities/8777
- https://www.exploit-db.com/exploits/41622/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/alienwithin/Scripts-Sploits