Blind Server-Side Request Forgery Vulnerability in Memberpress Plugin

CVE-2024-5031

What is CVE-2024-5031?

The Memberpress plugin for WordPress has a vulnerability that allows for Blind Server-Side Request Forgery. This issue affects all versions up to and including 1.11.29. Authenticated attackers with at least Contributor-level access can exploit the 'mepr-user-file' shortcode to send unauthorized web requests to arbitrary locations. This capability potentially enables the attackers to retrieve and alter sensitive information from internal services, posing a significant risk to the integrity of the web application and its associated data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References