Skip to main content

Paid Memberships Pro CVE-2024-37277

CRITICAL
Authorization Bypass Through User-Controlled Key (CWE-639)
2024-11-01 audit@patchstack.com
Authentication Bypass Paid Memberships Pro
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 01, 2024 - 15:15 nvd
CRITICAL 9.8

DescriptionNVD

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

AnalysisAI

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.0.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-639. Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.0.4. Affected products include: Strangerstudios Paid Memberships Pro. Version information: through 3.0.4..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Paid Memberships Pro

View all
CVE-2014-8801 MEDIUM POC
5.0 Nov 28

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress
CVE-2023-23488 CRITICAL POC
9.8 Jan 20

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit
CVE-2023-0631 HIGH POC
8.8 Mar 20

The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that conc
CVE-2023-6187 HIGH
7.5 Nov 18

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type vali
CVE-2024-1287 MEDIUM POC
6.5 Jul 30

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from

CVE-2015-5532 MEDIUM POC
6.1 Oct 23

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPr
CVE-2021-24979 MEDIUM POC
6.1 Dec 27

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an a
CVE-2024-1286 MEDIUM POC
4.9 Jul 30

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from lea
CVE-2021-20678 HIGH
8.8 Mar 18

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to
CVE-2020-36754 MEDIUM POC
4.3 Oct 20

The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi
CVE-2024-1279 MEDIUM POC
4.3 Mar 11

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from le
CVE-2024-37486 HIGH
7.2 Jul 09

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships P

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-37277 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy