CVE-2024-12919 Auth bypass in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Unauthenticated attackers can log in as any user by supplying a valid payment ID, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12919?
CVE-2024-12919 is a critical authentication bypass vulnerability in cozmoslabs Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.
Weakness: CWE-287
Which versions are affected by CVE-2024-12919?
It affects 1 product.
Products include Cozmoslabs Membership \& Content Restriction - Paid Member Subscriptions.
How do I fix CVE-2024-12919?
No fix has been published for CVE-2024-12919 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-12919 being exploited?
There is no known exploitation of CVE-2024-12919 in the wild and no public exploit code.
Other vulnerabilities in cozmoslabs Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2021-24728 Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
- CVE-2024-10261 Code injection in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-9222 Cross-site scripting in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-11291 Information disclosure in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-1389 Missing authorization in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Sources
Also known as GHSA-v73w-jc37-w35q.