WP-Members Membership Plugin < 3.4.9 - Contributor+ Sensitive Information Exposure

2024-01-0300:00:00

wpscan.com

plugin

vulnerability

sensitive information

authentication

attacker access

user data

6.9 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

18.2%

JSON

Description The plugin is vulnerable to Sensitive Information Exposure via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.