CVE-2024-2920 WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
Unauthenticated attackers can view sensitive files uploaded by other users due to unprotected storage in a publicly accessible directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2920?
CVE-2024-2920 is a medium-severity vulnerability in cbutlerjr WP-Members Membership Plugin, published on 26 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
Weakness: CWE-200
Which versions are affected by CVE-2024-2920?
How do I fix CVE-2024-2920?
No fix has been published for CVE-2024-2920 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2920 being exploited?
There is no known exploitation of CVE-2024-2920 in the wild and no public exploit code.
Sources
Also known as GHSA-pprv-m73j-58qg.