CVE-2024-0624
Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmpro_update_level_order() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
El complemento Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.12.7 incluida. Esto se debe a una validación nonce faltante o incorrecta en la función pmpro_update_level_order(). Esto hace posible que atacantes no autenticados actualicen el orden de los niveles a través de una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-01-16 CVE Reserved
- 2024-01-24 CVE Published
- 2024-02-01 EPSS Updated
- 2024-09-11 First Exploit
- 2024-10-18 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (4)
| URL | Date | SRC |
|---|---|---|
| https://github.com/kodaichodai/CVE-2024-0624 | 2024-09-11 |
| URL | Date | SRC |
|---|---|---|
| https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php | 2024-01-31 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Strangerstudios Search vendor "Strangerstudios" | Paid Memberships Pro Search vendor "Strangerstudios" for product "Paid Memberships Pro" | <= 2.12.7 Search vendor "Strangerstudios" for product "Paid Memberships Pro" and version " <= 2.12.7" | wordpress |
Affected
| ||||||