Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Paid_memberships_pro
(Strangerstudios)| Repositories | https://github.com/strangerstudios/paid-memberships-pro |
| #Vulnerabilities | 24 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-07-30 | CVE-2024-1286 | The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site. | Paid_memberships_pro | N/A | ||
| 2024-07-30 | CVE-2024-1287 | The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes. | Paid_memberships_pro | N/A | ||
| 2024-01-11 | CVE-2023-6855 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmpro_rest_api_get_permissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices. | Paid_memberships_pro | 5.3 | ||
| 2023-03-20 | CVE-2023-0631 | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query. | Paid_memberships_pro | 8.8 | ||
| 2024-03-11 | CVE-2024-1279 | The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata. | Paid_memberships_pro | 4.3 | ||
| 2024-06-19 | CVE-2023-39990 | Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3. | Paid_memberships_pro | 8.8 | ||
| 2024-04-24 | CVE-2024-32793 | Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10. | Paid_memberships_pro | 8.8 | ||
| 2024-11-01 | CVE-2024-37277 | Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4. | Paid_memberships_pro | 9.8 | ||
| 2024-04-24 | CVE-2024-32794 | Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10. | Paid_memberships_pro | 8.8 | ||
| 2024-04-09 | CVE-2024-0588 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmpro_lifter_save_streamline_option() function. This makes it possible for unauthenticated attackers to enable the streamline setting with Lifter LMS via a forged request granted they can trick a site administrator into performing an action such as... | Paid_memberships_pro | N/A |