CVE-2024-2920: WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2920?
CVE-2024-2920 is classified as a high severity vulnerability due to the exposure of sensitive user-uploaded files.
How do I fix CVE-2024-2920?
To fix CVE-2024-2920, update the WP-Members Membership Plugin to the latest version beyond 3.4.9.3.
What does CVE-2024-2920 affect?
CVE-2024-2920 affects the WP-Members Membership Plugin for WordPress in all versions up to and including 3.4.9.3.
What kind of information is exposed in CVE-2024-2920?
CVE-2024-2920 can potentially expose user-uploaded files due to the lack of access restrictions in a publicly accessible directory.
Who is impacted by CVE-2024-2920?
Users of the WP-Members Membership Plugin on WordPress using versions up to and including 3.4.9.3 are impacted by CVE-2024-2920.