CVE-2024-1407: Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
First published: Wed Jun 19 2024(Updated: )
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <3.0 |
Remedy
https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.10/includes/functions.php
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c46bcbd1-566d-4b21-84a1-f25e3df7ddc7?source=cve
- https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.10/includes/functions.php
- https://github.com/strangerstudios/paid-memberships-pro/pull/2893
- https://github.com/strangerstudios/paid-memberships-pro/pull/2839
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3058329%40paid-memberships-pro%2Ftrunk&old=3033153%40paid-memberships-pro%2Ftrunk&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-1407?
CVE-2024-1407 is categorized as a Cross-Site Request Forgery vulnerability with a medium severity level.
How do I fix CVE-2024-1407?
To fix CVE-2024-1407, update the Paid Memberships Pro plugin to version 2.12.11 or higher.
Which versions are affected by CVE-2024-1407?
All versions of the Paid Memberships Pro plugin up to and including 2.12.10 are affected by CVE-2024-1407.
What can exploit CVE-2024-1407?
CVE-2024-1407 can be exploited by an attacker to perform unauthorized actions on behalf of an authenticated user.
Is user input validation impacted in CVE-2024-1407?
Yes, CVE-2024-1407 is due to missing or incorrect nonce validation, affecting user input validation.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/source
- agent/remedy
- agent/tags
- agent/last-modified-date
- agent/softwarecombine
- vendor/strangerstudios