Login Sign Up

CVE-2024-1286

4.9 MEDIUM

📋 TL;DR

The pmpro-membership-maps WordPress plugin before version 0.7 contains an information disclosure vulnerability that allows users with at least contributor-level permissions to access sensitive membership information about other users. This affects WordPress sites using the vulnerable plugin version, potentially exposing user data to unauthorized internal users.

💻 Affected Systems

Products:
  • pmpro-membership-maps WordPress plugin
Versions: All versions before 0.7
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with the plugin enabled and at least one user with contributor role or higher.

📦 What is this software?

Paid Memberships Pro by Strangerstudios

View all CVEs affecting Paid Memberships Pro →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Contributors could extract complete membership databases including user details, payment information, and access patterns, leading to data breach and privacy violations.

🟠

Likely Case

Internal users with contributor access could view membership statuses and user information they shouldn't have access to, violating privacy expectations.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to potential minor data exposure that can be quickly detected and contained.

🌐 Internet-Facing: MEDIUM
🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated user with at least contributor privileges. No public exploit code identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.7

Vendor Advisory: https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b/

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find 'pmpro-membership-maps'
4. Click 'Update Now' if update available
5. If no update available, download version 0.7+ from WordPress repository
6. Deactivate old version, upload new version, activate

🔧 Temporary Workarounds

Temporary Access Restriction

all

Temporarily restrict contributor access or remove contributor roles until patch can be applied

Plugin Deactivation

all

Deactivate the pmpro-membership-maps plugin until patched version is available

🧯 If You Can't Patch

  • Implement strict role-based access controls and monitor contributor activity
  • Add additional authentication layers or IP restrictions for admin areas

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for pmpro-membership-maps version. If version is below 0.7, system is vulnerable.

Check Version:

wp plugin list --name=pmpro-membership-maps --field=version

Verify Fix Applied:

After updating, verify plugin version shows 0.7 or higher in WordPress admin plugins list.

📡 Detection & Monitoring

Log Indicators:

  • Unusual access patterns to membership data by contributor-level users
  • Multiple failed access attempts to restricted membership endpoints

Network Indicators:

  • Increased traffic to /wp-admin/admin-ajax.php with membership-related parameters

SIEM Query:

source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND query="action=pmpro_membership_maps*") AND user_role="contributor"

📊 Metadata

CVE ID: CVE-2024-1286
CVSS v3 Score: 4.9 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published: July 30, 2024
Last Updated: October 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON