Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions, 6126f80d6fcc17f2080b49119a502e1ea9dfbd45

CVE, Research URL: 6126f80d6fcc17f2080b49119a502e1ea9dfbd45
Home page URL: Security reports for Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Application: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Published on: Jan 06, 2021
Research Description: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions [paid-memberships-pro] < 2.5.3 (closed) Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.2 - IDOR to Sensitive Information Disclosure The Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions plugin for WordPress is vulnerable to sensitive information disclosure due to incorrect user validation and capabiltiy checking on the pmpro_get_order_json() function that made it possible for attackers to download order data for other users in versions up to, and including 2.5.2.
Affected versions: max 2.5.3.
Status: vulnerable

Paid Memberships Pro &#8211; Content Restriction, User Registration, &amp; Paid Subscriptions, 6126f80d6fcc17f2080b49119a502e1ea9dfbd45