Sensitive Information Exposure in SureMembers Plugin for WordPress
CVE-2024-12434

5.3MEDIUM

Key Information:

Vendor
Surecart
Status
Suremembers
Vendor
CVE Published:
26 February 2025

Summary

The SureMembers plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the REST API, leading to the exposure of sensitive information. This flaw affects all versions up to and including 1.10.6, enabling unauthorized access to restricted content that should be protected from exposure.

Affected Version(s)

SureMembers * <= 1.10.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://suremembers.com/whats-new/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.