CVE-2024-11008: 
WordPress vulnerability analysis and mitigation

The Members – Membership & User Role Editor Plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-11008) affecting all versions up to and including 3.2.10. The vulnerability was discovered and disclosed on December 11, 2024. The plugin is designed to manage user roles and content restrictions in WordPress installations (NVD).

The vulnerability exists in the way the plugin interacts with the WordPress core search feature. It has been assigned a CVSS v3.1 score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

When exploited, this vulnerability allows unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. This means content that should only be accessible to administrators could be exposed to any visitor of the website (NVD).

Site administrators running affected versions of the Members plugin should update to a version newer than 3.2.10 as soon as possible. The vulnerability has been addressed in newer versions of the plugin (NVD).