CVE-2024-5031
📋 TL;DR
The MemberPress WordPress plugin contains a blind server-side request forgery (SSRF) vulnerability that allows authenticated attackers with Contributor-level access or higher to make arbitrary web requests from the vulnerable server. This can be used to query and potentially modify internal services that should not be publicly accessible. All WordPress sites using MemberPress versions up to 1.11.29 are affected.
💻 Affected Systems
- MemberPress WordPress Plugin
📦 What is this software?
Memberpress by Caseproof
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, exfiltrate data from internal networks, or chain with other vulnerabilities to achieve remote code execution on internal systems.
Likely Case
Attackers with contributor access could probe internal networks, discover internal services, and potentially access metadata services or internal APIs that leak sensitive information.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to information disclosure about internal network structure and services.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. Contributor role is relatively easy to obtain in many WordPress installations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.30 or later
Vendor Advisory: https://memberpress.com/change-log/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MemberPress and click 'Update Now'. 4. Verify version is 1.11.30 or higher.
🔧 Temporary Workarounds
Disable 'mepr-user-file' shortcode
allRemove or disable the vulnerable shortcode functionality
Add to theme's functions.php: remove_shortcode('mepr-user-file');
Restrict user roles
allRemove Contributor role access or implement role-based access controls
Use WordPress role management plugins or custom code to restrict shortcode usage
🧯 If You Can't Patch
- Implement network segmentation to restrict outbound connections from web servers
- Deploy web application firewall (WAF) rules to block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for MemberPress version. If version is 1.11.29 or lower, system is vulnerable.Check Version:
wp plugin list --name=memberpress --field=versionVerify Fix Applied:
After update, confirm MemberPress version is 1.11.30 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server to internal IPs
- Multiple failed authentication attempts followed by successful Contributor login
Network Indicators:
- Web server making requests to internal services (169.254.169.254, 10.x, 172.16.x, 192.168.x)
- Unusual traffic patterns from web server to non-standard ports
SIEM Query:
source="web_server_logs" AND (dest_ip=10.* OR dest_ip=172.16.* OR dest_ip=192.168.* OR dest_ip=169.254.169.254) AND user_agent CONTAINS "WordPress"