CVE-2024-1286 Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure
Contributors can leak sensitive membership information about other users in the Paid Memberships Pro Maps plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1286?
CVE-2024-1286 is a medium-severity vulnerability in Unknown pmpro-membership-maps, published on 30 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
Which versions are affected by CVE-2024-1286?
It affects 1 product.
Products include Strangerstudios Paid Memberships Pro.
How do I fix CVE-2024-1286?
No fix has been published for CVE-2024-1286 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1286 exists.
Other vulnerabilities in Unknown pmpro-membership-maps
- CVE-2023-23488 SQL injection in Paid Memberships Pro WordPress Plugin
- CVE-2021-25114 Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
- CVE-2023-0631 Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
- CVE-2021-20678 SQL injection in Paid Memberships Pro
- CVE-2024-37486 WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability
Sources
Also known as GHSA-6r36-crx2-h5cg.