WordSec
WordSec

Paid Memberships Pro <= 2.12.6 - Information Exposure in Debug Logs

2024-01-12 00:00
Anonymous

Strategic Overview

Status
Patched in 2.12.7
Affected PluginPaid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected Version<= 2.12.6
CVSS5.3Medium
CVEN/A
View all Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions vulnerabilities

Vulnerability Overview

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.12.6 via debug logs. This makes it possible for unauthenticated attackers to extract sensitive data including user passwords through debug logs.

Technical Analysis

REMEDIATION: Update to version 2.12.7, or a newer patched version --- IDENTIFIER: CWE-215 (Insertion of Sensitive Information Into Debugging Code) The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/852b1895-3bed-4c2f-912c-c136b38a09bb

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C