PT-2024-15903 · WordPress · S2Member

Francesco Carlucci · Published 2024-04-09 · Updated 2024-04-10 · CVE-2024-0899

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions s2Member plugin for WordPress versions prior to 230816

Description The issue allows unauthenticated attackers to expose information via the API, making it possible to see the contents of posts and pages.

Recommendations For versions prior to 230816, update to version 230816 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-0899

Affected Products

S2Member

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-0899 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051411%40s2member%2Ftrunk&old=3037346%40s2member%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/80bfb470-a3df-497f-940d-051ccaa6215b?source=cve · Note