CVE-2024-11090: 
WordPress vulnerability analysis and mitigation

The Membership Plugin – Restrict Content plugin for WordPress (CVE-2024-11090) is a sensitive information exposure vulnerability affecting all versions up to and including 3.2.13. The vulnerability was discovered and reported by Wordfence on January 26, 2025, and affects the WordPress core search feature functionality (NVD Details).

The vulnerability allows unauthorized access to restricted content through the WordPress core search feature. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST and 5.3 (MEDIUM) by Wordfence, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD Details).

When exploited, this vulnerability enables unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. This represents a significant breach of content restriction mechanisms and could lead to unauthorized access to privileged information (NVD Details).

A patch has been released to address this vulnerability. Users are advised to update to version 3.2.14 or later of the Membership Plugin – Restrict Content plugin (WordPress Patch).