CVE-2024-3215: medium-severity vulnerability in strangerstudios Paid Memberships Pro – Content…
Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery
Published · Updated
Follow this CVE+ Monitor Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmpro_update_level_group_order() function. This makes it possible for unauthenticated attackers to update order levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
strangerstudios · Paid Memberships Pro – Content Restriction, User Registration, & Paid SubscriptionsRelated CVEs — strangerstudios Paid Memberships Pro – Content…
In the same product, most dangerous first.
CVE-2023-6187HIGHPaid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 51.3%CVE-2024-0624MEDIUMPaid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders UpdateEPSS 1.0%CVE-2024-0588MEDIUMPaid Memberships Pro <= 2.12.10 - Cross-Site Request ForgeryEPSS 0.9%CVE-2023-6855MEDIUMPaid Memberships Pro <= 2.12.5 - Missing Authorization via APIEPSS 0.5%CVE-2020-36754MEDIUMPaid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2026-15016MEDIUMPaid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%