CVE-2024-1286 – Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure

https://notcve.org/view.php?id=CVE-2024-1286

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site. The Paid Memberships Pro - Membership Maps Add On plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 0.7 (exclusive) through the 'pmpro_membership_maps' shortcode. This makes it possible for authenticated attackers, with Ccntributor-level access and above, to extract sensitive user meta data. • https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b • CWE-639: Authorization Bypass Through User-Controlled Key •