Blind Server-Side Request Forgery Vulnerability in Memberpress Plugin
CVE-2024-5031

8.5HIGH

Key Information:

Vendor
Wordpress
Status
Memberpress
Vendor
CVE Published:
22 May 2024

Summary

The Memberpress plugin for WordPress has a vulnerability that allows for Blind Server-Side Request Forgery. This issue affects all versions up to and including 1.11.29. Authenticated attackers with at least Contributor-level access can exploit the 'mepr-user-file' shortcode to send unauthorized web requests to arbitrary locations. This capability potentially enables the attackers to retrieve and alter sensitive information from internal services, posing a significant risk to the integrity of the web application and its associated data.

Affected Version(s)

Memberpress * <= 1.11.29

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://memberpress.com/change-log/

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Rollings
.