Description

WordPress Plugin Paid Memberships Pro-Content Restriction, User Registration, & Paid Subscriptions is prone to a insecure direct object reference (IDOR) vulnerability. Exploiting this issue may allow an attacker to update an order status to paid. WordPress Plugin Paid Memberships Pro-Content Restriction, User Registration, & Paid Subscriptions version 3.0.4 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.0.5 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/paid-memberships-pro/paid-memberships-pro-304-unauthenticated-insecure-direct-object-reference-to-order-status-update

https://plugins.svn.wordpress.org/paid-memberships-pro/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin WP Advanced Importer Cross-Site Scripting (2.1.1)

WordPress Plugin File Manager Advanced Shortcode Directory Traversal (2.4)

Moodle Improper Authentication Vulnerability (CVE-2021-40693)

PHP Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2004-0594)

WordPress Plugin Delete All Comments Easily Cross-Site Request Forgery (1.3)

Severity

High

Classification

CVE-2024-37277 CWE-639 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update