CVE-2024-0624

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-0624

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0624.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-0624

Published

2024-01-25T01:55:02.762Z

Modified

2026-07-15T01:48:50.795744887Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

Details

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmproupdatelevel_order() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Database specific

{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-352"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.12.7"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0624.json"
}

References

Affected packages

Git / github.com/strangerstudios/paid-memberships-pro

Affected ranges

Type

GIT

Repo

https://github.com/strangerstudios/paid-memberships-pro

Events

Introduced

Last affected

da798bd2b49164f559aa007fdef5d6179bfcd954

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.12.7"
        }
    ]
}

Affected versions

2.*

2.10

2.10-RC1

2.10-RC2

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.11

2.11.1

2.11.2

2.12

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

2.12.6

2.12.7

2.6

2.6.1

2.6.1.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.7

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.8

2.8.1

2.8.2

2.8.3

2.9.1

2.9.2

2.9.3

2.9.4

archive/v1.*

archive/v1.9.4

release-1.*

release-1.8

release-1.8.1

release-1.8.10.1

release-1.8.10.2

release-1.8.10.3

release-1.8.10.4

release-1.8.11

release-1.8.11.1

release-1.8.11.2

release-1.8.12

release-1.8.12.1

release-1.8.13

release-1.8.13.1

release-1.8.13.2

release-1.8.13.3

release-1.8.13.4

release-1.8.13.5

release-1.8.13.6

release-1.8.2

release-1.8.2.2

release-1.8.3

release-1.8.4

release-1.8.4.2

release-1.8.4.3

release-1.8.4.5

release-1.8.6.6

release-1.8.6.7

release-1.8.6.8

release-1.8.7

release-1.8.7.3

release-1.8.8

release-1.8.8.1

release-1.8.8.3

release-1.8.9

release-1.8.9.1

release-1.9

release-1.9.1

release-1.9.2

release-1.9.2.1

release-1.9.3

release-1.9.4

release-1.9.4.1

release-1.9.4.2

release-1.9.4.3

release-1.9.4.4

release-v1.*

release-v1.8.2.1

v1.*

v1.7.5

v2.*

v2.0

v2.0.1

v2.0.2

v2.0.3

v2.0.4

v2.0.5

v2.0.7

v2.2

v2.2.2

v2.2.3

v2.2.4

v2.2.5

v2.2.6

v2.3.3

v2.3.4

v2.4

v2.4.1

v2.4.2

v2.4.3

v2.4.4

v2.5

v2.5.1

v2.5.2

v2.5.4

v2.5.5

v2.5.6

v2.5.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0624.json"