CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

2024-03-1117:56:06

WPScan

github.com

cve-2024-1279

paid memberships pro

wordpress plugin

contributor role

metadata disclosure

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users’ sensitive metadata.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wordpress:paid_memberships_pro:*:*:*:*:*:*:*:*"
    ],
    "vendor": "wordpress",
    "product": "paid_memberships_pro",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.12.9",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]