CVE-2024-0588: Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmproliftersavestreamlineoption() function. This makes it possible for unauthenticated attackers to enable the streamline setting with Lifter LMS via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-32793 and CVE-2024-32794 appear to be a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0588?
CVE-2024-0588 has been classified as a high severity vulnerability due to the potential for Cross-Site Request Forgery.
How do I fix CVE-2024-0588?
To fix CVE-2024-0588, update the Paid Memberships Pro plugin to version 3.0 or higher.
What is affected by CVE-2024-0588?
CVE-2024-0588 affects all versions of the Paid Memberships Pro plugin for WordPress up to 2.12.10.
What type of vulnerability is CVE-2024-0588?
CVE-2024-0588 is a Cross-Site Request Forgery (CSRF) vulnerability.
How does CVE-2024-0588 impact my website?
If exploited, CVE-2024-0588 could allow an attacker to perform unauthorized actions on behalf of the logged-in user.