CVE-2024-0687: Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account or user interaction is required.

Q: What information could be exposed?

The issue can allow attackers to retrieve the contents of WordPress posts and pages through the API.

Q: Which installations are affected?

Installations using the Restrict User Access – Ultimate Membership & Content Protection WordPress plugin version 2.5 or earlier are affected.

Q: Is a fix available?

Yes. A patch is available, so affected installations should update the plugin.

Published Mar 13, 2024

Updated

The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API.

Affected Software

2 affected components

Dev.institute Restrict User Access Wordpress<2.6

Ultimate Membership & Content Protection Restrict User Access<=2.5

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037773%40restrict-user-access%2Ftrunk&old=3010745%40restrict-user-access%2Ftrunk&sfp_email=&sfph_mail=

Event History

Mar 13, 2024

CVE Published

via MITRE·03:27 PM

Data Sourced

via MITRE·03:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account or user interaction is required.

What information could be exposed?

The issue can allow attackers to retrieve the contents of WordPress posts and pages through the API.

Which installations are affected?

Installations using the Restrict User Access – Ultimate Membership & Content Protection WordPress plugin version 2.5 or earlier are affected.

Is a fix available?

Yes. A patch is available, so affected installations should update the plugin.

CVE-2024-0687: Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which installations are affected?

Is a fix available?