CVE-2024-1407: 
WordPress vulnerability analysis and mitigation

The Paid Memberships Pro WordPress plugin versions 2.12.10 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability has been assigned CVE-2024-1407 and was discovered in April 2024 (Patchstack).

The vulnerability stems from missing or incorrect nonce validation on multiple functions within the plugin. The issue has been assigned a CVSS score of 5.4, indicating a low severity impact (Patchstack).

This vulnerability could allow an attacker to force higher privileged users to execute unwanted actions under their current authentication. The impact is considered low severity and is unlikely to be exploited in most scenarios (Patchstack).

The vulnerability requires user interaction to be exploited, as the target must visit a malicious page or perform specific actions. The attack vector is classified as unauthenticated, meaning the attacker doesn't need to be logged into the system to attempt exploitation (Patchstack).

The vulnerability has been fixed in version 3.0 of the Paid Memberships Pro plugin. Users are advised to update to version 3.0 or later to remove the vulnerability. The fix includes the implementation of proper nonce validation on the affected functions (Patchstack).