WordPress Plugin Vulnerabilities

Paid Memberships Pro < 2.12.7 - Information Exposure in Debug Logs

Description

The plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.12.6 via debug logs. This makes it possible for unauthenticated attackers to extract sensitive data including user passwords through debug logs.

Affects Plugins

Plugin icon
paid-memberships-pro
Fixed in 2.12.7

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/852b1895-3bed-4c2f-912c-c136b38a09bb

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
2cbbb800-ff5b-4c5e-8500-2554ff4c3001

Timeline

Publicly Published
2024-01-12 (about 2 years ago)
Added
2024-03-13 (about 2 years ago)
Last Updated
2024-03-13 (about 2 years ago)

Other

Published
Title
Published
2024-02-26
Title
Elementor Pro < 3.19.3 - Authenticated (Contributor+) Information Exposure
Published
2024-07-15
Title
AForms < 2.2.7 - Unauthenticated Full Path Disclosure
Published
2024-06-20
Title
WP 2FA < 2.6.4 - Unauthenticated Information Exposure via Log File
Published
2024-12-07
Title
WP Mailster < 1.8.17.0 - Unauthenticated Sensitive Information Exposure
Published
2026-03-20
Title
e-shot <= 1.0.2 - Subscriber+ API Token Disclosure