PT-2024-17768 · WordPress · Pmpro-Membership-Maps

Scott Kingsley Clark · Published 2024-07-30 · Updated 2025-08-29 · CVE-2024-1286

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pmpro-membership-maps versions prior to 0.7

Description The issue allows users with at least the contributor role to leak sensitive information about users with a membership on the site. This is due to the lack of proper access control in the pmpro-membership-maps WordPress plugin.

Recommendations For versions prior to 0.7, update to version 0.7 or later to resolve the issue. As a temporary workaround, consider restricting the contributor role's access to sensitive membership information until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2024-1286

Affected Products

Pmpro-Membership-Maps

References · 7

• 🔥 https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1286 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1286 · Vendor Advisory
• https://t.me/cvenotify/87861 · Telegram Post
• https://t.me/cvedetector/1993 · Telegram Post
• https://t.me/cveNotify/133951 · Telegram Post
• https://t.me/cvenotify/128415 · Telegram Post