Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

2024-02-1600:00:00

Scott Kingsley Clark

paid memberships pro

contributor

arbitrary user

custom field disclosure

exploit

shortcode.

AI Score

6.7

Confidence

Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not prevent user with at least the contributor role from leaking other users’ sensitive metadata.

As a contributor,
- Add shortcode to any post and specify/guess any user ID and meta key and save
- Preview the post and see custom field value outputs from any user

Example shortcode: `[pmpro_member user_id="ANY_USER_ID" field="ANY_META_KEY"]`