MEDIUM🇵🇱 Wersja polska

CVE-2024-1287

CVSS 6.5v3.1pub. 2024-07-30upd. 2025-08-22

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Strangerstudios Paid Memberships Pro

    APP
    Strangerstudios
    < 1.2.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-23488CRITICAL9.8ten sam produkt

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vu...

CVE-2021-25114CRITICAL9.8ten sam produkt

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST ro...

CVE-2024-37277HIGH7.5ten sam produkt

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functi...

CVE-2024-37486HIGH7.6ten sam produkt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Mem...

CVE-2023-6187HIGH7.5ten sam produkt

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file...