CVE-2024-11083 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

What is CVE-2024-11083?

CVE-2024-11083 is a medium-severity vulnerability in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, published on 27 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

Weakness: CWE-200

Which versions are affected by CVE-2024-11083?

It affects 1 product.

Products include Properfraction Profilepress.

How do I fix CVE-2024-11083?

No fix has been published for CVE-2024-11083 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-11083 being exploited?

There is no known exploitation of CVE-2024-11083 in the wild and no public exploit code.

Other vulnerabilities in properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

• CVE-2021-34621 ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation Critical 9.8
• CVE-2021-34622 ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation Critical 9.8
• CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component Critical 9.8
• CVE-2021-34624 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component Critical 9.8
• CVE-2023-41954 WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w6gg-264j-7prm.