Sensitive Information Exposure in WordPress Membership Plugin

CVE-2024-8326

Summary

CVE-2024-8326 is a critical vulnerability in the s2Member plugin for WordPress, affecting all versions up to and including 241114. This vulnerability arises from the 'sc_get_details' function, allowing authenticated attackers with Contributor-level access or higher to access sensitive information such as user data and database configuration details. This exposure could lead to unauthorized reading, modification, or deletion of database tables, jeopardizing the security of sensitive user information and website integrity. A partial patch was introduced in version 241114, but users are advised to upgrade to mitigate associated risks.

References