CVE-2024-11294: 
WordPress vulnerability analysis and mitigation

The Memberful plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-11294) affecting all versions up to and including 1.73.9. The vulnerability was discovered and disclosed on December 17, 2024. This security issue affects the WordPress core search feature functionality within the Memberful plugin (NVD CVE).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and no requirements for privileges or user interaction (NVD CVE).

The vulnerability allows unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as site members. This means that content intended only for authenticated members could potentially be accessed by unauthorized users (NVD CVE).

A fix has been implemented in the WordPress plugin repository, as evidenced by the changeset 3204895 (WordPress Plugin). Users are advised to update their Memberful plugin to the latest version beyond 1.73.9.