CVE-2024-3215: Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder() function. This makes it possible for unauthenticated attackers to update order levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3215?
CVE-2024-3215 is classified as a medium severity vulnerability due to the potential for Cross-Site Request Forgery.
How do I fix CVE-2024-3215?
To fix CVE-2024-3215, update the Paid Memberships Pro plugin to version 3.0.2 or later.
What versions are affected by CVE-2024-3215?
CVE-2024-3215 affects all versions of the Paid Memberships Pro plugin up to and including version 3.0.1.
What type of vulnerability is CVE-2024-3215?
CVE-2024-3215 is a Cross-Site Request Forgery (CSRF) vulnerability.
What function is vulnerable in CVE-2024-3215?
The pmpro_update_level_group_order() function is vulnerable in CVE-2024-3215 due to missing or incorrect nonce validation.