The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmpro_update_level_order() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
History

Fri, 18 Oct 2024 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-01-25T01:55:02.762Z

Updated: 2024-10-18T15:24:41.407Z

Reserved: 2024-01-16T19:17:26.021Z

Link: CVE-2024-0624

cve-icon Vulnrichment

Updated: 2024-08-01T18:11:35.653Z

cve-icon NVD

Status : Modified

Published: 2024-01-25T02:15:53.243

Modified: 2024-11-21T08:47:01.550

Link: CVE-2024-0624

cve-icon Redhat

No data.