Simple Membership
CVE-2024-11088
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 7.5 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. |
| Exploit ScenarioDerived | A remote attacker could access sensitive data that should not be disclosed by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Affected products include: Simple-Membership-Plugin Simple Membership.
Know when Simple Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Simple Membership
View allThe Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due
Account takeover of the primary WordPress administrator affects the Simple Membership plugin in all versions before 4.7.
Stored/reflected cross-site scripting in the Simple Membership WordPress plugin before 4.7.5 lets unauthenticated attack
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editi
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Rated high severi
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which
Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to i
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting t
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain highe
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL quer
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could
Unauthenticated attackers can redirect activation and registration-complete emails to an arbitrary address in Simple Mem
GitHub PoC
Exploit-DB