CVE-2024-10537: 
WordPress vulnerability analysis and mitigation

The WP User Manager – User Profile Builder & Membership plugin for WordPress contains a vulnerability (CVE-2024-10537) discovered in versions up to and including 2.9.11. The vulnerability stems from a missing capability check on the validate_user_meta_key() function, which allows authenticated attackers with Subscriber-level access or higher to enumerate user meta keys (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness has been classified as CWE-862: Missing Authorization, indicating a fundamental security control issue in the authentication mechanism (NVD, Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level privileges or higher to enumerate user meta keys, potentially exposing sensitive user information (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

A patch has been released to address this vulnerability. Users should upgrade to a version newer than 2.9.11 to protect against this security issue (WordPress Plugin).