💣Exploit CVE-2024-12919 - "Easy Memberships authentication bypass in WordPress Paid Membership Subscriptions"

[Maksim]

CVE ID : CVE-2024-12919
Published : Jan. 14, 2025, 10:15 a.m. | 39 minutes ago
Description : The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Full story here:

To view the content, you need to Sign In or Register.