CVE-2024-1279: 
WordPress vulnerability analysis and mitigation

The Paid Memberships Pro WordPress plugin versions before 2.12.9 contains a security vulnerability that allows users with at least contributor-level permissions to access and leak other users' sensitive metadata (WPScan).

The vulnerability is classified as an Access Controls issue with a CVSS score of 4.9 (medium severity). It is categorized under OWASP Top 10 as A5: Broken Access Control and CWE-284. The vulnerability was discovered by Scott Kingsley Clark and was publicly disclosed on February 16, 2024 (WPScan).

This vulnerability allows users with contributor privileges to access and expose sensitive metadata belonging to other users on the WordPress site. The exposure of such information could lead to privacy breaches and potential misuse of personal information (WPScan).

The vulnerability can be exploited by adding a specific shortcode to any post, specifying any user ID and meta key. The exploit can be triggered by previewing the post, which will output custom field values from any targeted user. The proof of concept involves using the shortcode format: [pmpro_member user_id="ANY_USER_ID" field="ANY_META_KEY"] (WPScan).

The vulnerability has been fixed in version 2.12.9 of the Paid Memberships Pro plugin. Site administrators are strongly advised to update to this version or later to prevent unauthorized access to user metadata (WPScan).