CVE-2024-11088: Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11088?
CVE-2024-11088 is classified as a high severity vulnerability due to the potential for unauthorized data exposure.
How do I fix CVE-2024-11088?
To fix CVE-2024-11088, update your Simple Membership plugin to version 4.5.6 or later.
Who is affected by CVE-2024-11088?
CVE-2024-11088 affects all installations of the Simple Membership plugin for WordPress prior to version 4.5.6.
What kind of sensitive information can be exposed by CVE-2024-11088?
CVE-2024-11088 can lead to the exposure of potentially sensitive data from restricted posts accessible through the WordPress search feature.
Is CVE-2024-11088 exploitable by authenticated users?
CVE-2024-11088 can be exploited by unauthenticated users, which increases the risk of sensitive information exposure.