CVE-2024-11088 — Sensitive Information Exposure in Simple Membership

CWE-200 — Sensitive Information ExposureCWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.6%
top 31.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Simple-membership-plugin Simple MembershipWpinsider-1 Simple Membership
Timeline
PublishedNov 21
Latest updateApr 5

Description

The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-mrp2-g378-9whc: The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4↗2025-04-05
▶
CVEList
Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor↗2024-11-21
▶
CVE-2024-11088 — Sensitive Information Exposure | cvebase