CVE-2024-0588

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
9.3%
top 7.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Strangerstudios Paid Memberships PRO
Timeline
PublishedApr 9

Description

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmpro_lifter_save_streamline_option() function. This makes it possible for unauthenticated attackers to enable the streamline setting with Lifter LMS via a forged request granted they can trick a site administrator into performing an action such as clic…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery↗2024-04-09
▶
GHSA
GHSA-7p7p-r9pc-pcmf: The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forge↗2024-04-09
▶
CVE-2024-0588 (MEDIUM CVSS 4.3) | The Paid Memberships Pro – Content | cvebase.io