Plateforme
wordpress
Composant
paid-member-subscriptions
Corrigé dans
2.13.1
CVE-2024-10261 describes an arbitrary shortcode execution vulnerability discovered in the Paid Membership Subscriptions plugin for WordPress. This flaw allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized access and modification of website content. The vulnerability impacts versions of the plugin up to and including 2.13.0. A patch is available in later versions.
The arbitrary shortcode execution vulnerability poses a significant risk to WordPress websites utilizing the Paid Membership Subscriptions plugin. An attacker could leverage this flaw to inject malicious code through shortcodes, potentially gaining control over website functionality. This could involve defacing the website, stealing sensitive user data, or even installing malware. The impact is amplified if the website handles sensitive information or processes transactions, as attackers could exploit the vulnerability to compromise user accounts and financial data. The ability to execute arbitrary shortcodes bypasses standard security measures, making it a particularly dangerous vulnerability.
This vulnerability was publicly disclosed on 2024-11-09. Currently, there are no confirmed reports of active exploitation in the wild. Public proof-of-concept code may be available, increasing the risk of exploitation. It is recommended to apply the patch promptly to prevent potential attacks. The vulnerability is not currently listed on the CISA KEV catalog.
WordPress websites utilizing the Paid Membership Subscriptions plugin, particularly those running versions 2.13.0 or earlier, are at risk. Sites with limited security monitoring or those that haven't implemented a robust plugin update process are especially vulnerable. Shared hosting environments where plugin updates are managed by the hosting provider should also be monitored closely.
• wordpress / composer / npm:
grep -r 'do_shortcode' /var/www/html/wp-content/plugins/paid-membership-subscriptions/• wordpress / composer / npm:
wp plugin list --status=all | grep 'Paid Membership Subscriptions'• wordpress / composer / npm:
wp plugin update --alldisclosure
Statut de l'Exploit
EPSS
1.23% (percentile 79%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2024-10261 is to upgrade the Paid Membership Subscriptions plugin to a version newer than 2.13.0, where the vulnerability has been addressed. If immediate upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the shortcode functionality or implementing stricter input validation on shortcode parameters. While a WAF might offer some protection, it's not a substitute for patching the plugin. Regularly review WordPress plugin updates and security advisories to stay informed about potential vulnerabilities.
Actualice el plugin Paid Membership Subscriptions a la última versión disponible. La vulnerabilidad permite la ejecución de shortcodes arbitrarios sin autenticación, por lo que es crucial actualizar para mitigar el riesgo.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2024-10261 is a HIGH severity vulnerability in the Paid Membership Subscriptions plugin for WordPress, allowing unauthenticated attackers to execute arbitrary shortcodes due to insufficient input validation.
Yes, if you are using Paid Membership Subscriptions plugin versions 2.13.0 or earlier, you are vulnerable to this arbitrary shortcode execution flaw.
Upgrade the Paid Membership Subscriptions plugin to a version newer than 2.13.0. If immediate upgrade is not possible, consider temporary restrictions on shortcode functionality.
While there are no confirmed reports of active exploitation, the availability of potential proof-of-concept code increases the risk of exploitation.
Refer to the official Paid Membership Subscriptions website and WordPress plugin repository for the latest security advisories and updates related to CVE-2024-10261.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.