CVE-2024-11291: 
WordPress vulnerability analysis and mitigation

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-11291) affecting all versions up to and including 2.13.4. The vulnerability was discovered by Francesco Carlucci and publicly disclosed on December 17, 2024 (Wordfence Advisory).

The vulnerability exists in the WordPress core search feature implementation within the plugin. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness is categorized as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD).

This vulnerability allows unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users. This means that content intended to be private or restricted can be accessed by unauthorized users (NVD).

The vulnerability can be exploited by unauthenticated attackers through the WordPress core search feature, requiring no special privileges or user interaction. The attack vector is network-accessible and has low attack complexity (NVD).

A patch has been released to address this vulnerability. Users should upgrade to version 2.13.5 or later of the Paid Membership Subscriptions plugin (WordPress Patch).