CVE-2024-1279

Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.

Affected

Paid Memberships Pro

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2024-03-11

Updated

2025-03-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4c537264-0c23-428e-9a11-7a9e74fb6b69/

Security advisories

• https://wpscan.com/vulnerability/4c537264-0c23-428e-9a11-7a9e74fb6b69

References

• CVE Record
• NVD entry