CVE-2024-1407mediumCWE-352

CVE-2024-1407: medium-severity vulnerability in strangerstudios Paid Memberships Pro – Content…

Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification

Published · Updated

Follow this CVE+ Monitor Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
strangerstudios · Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Related CVEs — strangerstudios Paid Memberships Pro – Content…

In the same product, most dangerous first.

CVE-2023-6187HIGHPaid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 51.3%CVE-2024-0624MEDIUMPaid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders UpdateEPSS 1.0%CVE-2024-0588MEDIUMPaid Memberships Pro <= 2.12.10 - Cross-Site Request ForgeryEPSS 0.9%CVE-2023-6855MEDIUMPaid Memberships Pro <= 2.12.5 - Missing Authorization via APIEPSS 0.5%CVE-2020-36754MEDIUMPaid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2024-3215MEDIUMPaid Memberships Pro <= 3.0.1 - Cross-Site Request ForgeryEPSS 0.3%