CVE-2024-1407: Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1407?
CVE-2024-1407 is categorized as a Cross-Site Request Forgery vulnerability with a medium severity level.
How do I fix CVE-2024-1407?
To fix CVE-2024-1407, update the Paid Memberships Pro plugin to version 2.12.11 or higher.
Which versions are affected by CVE-2024-1407?
All versions of the Paid Memberships Pro plugin up to and including 2.12.10 are affected by CVE-2024-1407.
What can exploit CVE-2024-1407?
CVE-2024-1407 can be exploited by an attacker to perform unauthorized actions on behalf of an authenticated user.
Is user input validation impacted in CVE-2024-1407?
Yes, CVE-2024-1407 is due to missing or incorrect nonce validation, affecting user input validation.