Paid Memberships Pro – Membership Maps Add On < 0.7 – Contributor+ Sensitive Information Disclosure | CVE 2024-1286 | Plugin Vulnerabilities

Description

The plugin does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.

Proof of Concept

1. ADMIN: Install Paid Memberships Pro
2. ADMIN: Install Paid Memberships Pro Membership Maps Add On
3. CONTRIBUTOR: Add shortcode to any post and save
4. CONTRIBUTOR: Preview the post and see list of all members for a site and see it lists sensitive user information including user level etc
5. ANYONE: If the post/page ends up being published with the shortcode, anyone without authentication can see the exposed details

Example shortcode: `[pmpro_membership_maps fields="Login,user_login;User ID,ID;User level,wp_user_level"]`

Affects Plugins

pmpro-membership-maps

Fixed in 0.7

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Scott Kingsley Clark

Submitter

Scott Kingsley Clark

Submitter website

https://skc.dev

Submitter twitter

Verified

Yes

WPVDB ID

49dc9ca3-d0ef-4a75-8b51-307e3e44e91b

Timeline

Publicly Published

2024-07-09 (about 2 years ago)

Added

2024-07-09 (about 2 years ago)

Last Updated

2025-08-22 (about 11 months ago)

Other

Published

Title

Published

2026-08-10

Title

Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

Published

2026-07-29

Title

PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR

Published

2026-08-10

Title

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

Published

2025-01-31

Title

WP Job Portal < 2.2.7 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion

Published

2022-11-24

Title

WooCommerce Product Vendors < 2.1.69 - Vendor Commission Percentage Update via IDOR