CVE-2024-0624: Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmproupdatelevelorder() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0624?
CVE-2024-0624 is classified as a medium severity vulnerability due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2024-0624?
To mitigate CVE-2024-0624, upgrade the Paid Memberships Pro plugin to version 2.12.8 or later, which implements proper nonce validation.
Which versions are affected by CVE-2024-0624?
CVE-2024-0624 affects all versions of the Paid Memberships Pro plugin up to and including 2.12.7.
What type of vulnerability is CVE-2024-0624?
CVE-2024-0624 is a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited due to missing nonce validation.
Who is the vendor of the affected software for CVE-2024-0624?
The vendor of the affected software for CVE-2024-0624 is Stranger Studios.