CVE-2023-44150 WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

What is CVE-2023-44150?

CVE-2023-44150 is a high-severity vulnerability in Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.

Weakness: CWE-200

Which versions are affected by CVE-2023-44150?

It affects 1 product.

Products include Properfraction Profilepress.

How do I fix CVE-2023-44150?

No fix has been published for CVE-2023-44150 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-44150 being exploited?

There is no known exploitation of CVE-2023-44150 in the wild and no public exploit code.

Other vulnerabilities in Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

• CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation Critical 9.8
• CVE-2021-34622 ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation Critical 9.8
• CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component Critical 9.8
• CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component Critical 9.8
• CVE-2023-41954 WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vmpx-77rh-vj42.