Sensitive Information Exposure Vulnerability in Opal Membership

CVE-2024-7648

Summary

The Opal Membership plugin for WordPress is susceptible to a vulnerability that permits authenticated users, with subscriber-level access and higher, to gain unauthorized visibility into private notes associated with payments. This occurs due to the interaction with WordPress comments, which are not sufficiently restricted to administrators, thereby exposing sensitive information that should remain confidential. As a result, attackers can exploit this flaw to access data intended only for administrators, raising significant security concerns for website owners and users.

References