CVE-2014-8948: Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPr...

Security readout for executives and security teams

This is an old WordPress plugin issue in iMember360 versions 3.8.012 through 3.9.001. It could let an attacker trick a logged-in administrator into making an unintended request. The published record says the impact is unspecified, but also references command execution when combined with another weakness. Evidence is incomplete, so exposure depends on whether legacy iMember360 is still installed. Likely limited to WordPress sites still running iMember360 3.8.012 through 3.9.001, or sites with unknown plugin inventory. Modern sites without this plugin are not exposed based on the provided sources. Treat this as a targeted legacy-platform risk. It is high priority only if affected iMember360 versions remain in production or version visibility is missing. No source confirms active exploitation, so prioritize inventory, removal, and vendor-supported remediation over incident response escalation. Mitigation focus: Inventory WordPress sites for the iMember360 plugin and exact version.; Remove the plugin if unused or unsupported.; Check vendor guidance for fixed versions or replacement recommendations..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.