CVE-2024-1279

CWE-284 — Improper Access Control3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.5%
top 34.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Paid Memberships PROStrangerstudios Paid Memberships PRO
Timeline
PublishedMar 11

Description

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5unknown/paid_memberships_pro< 2.12.9

🔴Vulnerability Details

2
CVEList
Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure↗2024-03-11
▶
GHSA
GHSA-683m-h868-4cxr: The Paid Memberships Pro WordPress plugin before 2↗2024-03-11
▶
CVE-2024-1279 (MEDIUM CVSS 4.3) | The Paid Memberships Pro WordPress | cvebase.io