The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MemberPress | Memberpress | unaffected |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-46298 | The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 31 Jan 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Caseproof
Caseproof memberpress |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:2.3:a:caseproof:memberpress:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Caseproof
Caseproof memberpress |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2024-08-01T21:03:09.667Z
Reserved: 2024-05-16T20:22:17.469Z
Link: CVE-2024-5031
Vulnrichment
Updated: 2024-08-01T21:03:09.667Z
NVD
Status : Analyzed
Published: 2024-05-22T09:15:13.350
Modified: 2025-01-31T14:18:23.003
Link: CVE-2024-5031
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses