Lucene search

Scott Kingsley ClarkWPVDB-ID:4C537264-0C23-428E-9A11-7A9E74FB6B69

HistoryFeb 16, 2024 - 12:00 a.m.

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

2024-02-1600:00:00

Scott Kingsley Clark

wpscan.com

paid memberships pro

plugin

contributor role

user metadata

arbitrary

custom field

disclosure

vulnerability

user id

shortcode

sensitive

software

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not prevent user with at least the contributor role from leaking other users’ sensitive metadata.

PoC

As a contributor, - Add shortcode to any post and specify/guess any user ID and meta key and save - Preview the post and see custom field value outputs from any user Example shortcode: [pmpro_member user_id="ANY_USER_ID" field="ANY_META_KEY"]

CPENameOperatorVersion
eq2.12.9

CPE	Name	Operator	Version
		eq	2.12.9