Log in Start free

Vulnerability · Published Dec 17, 2024 · Assigned by Wordfence

CVE-2024-8326s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure

High 8.8

In plain English

A high-severity information exposure in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions from clavaque. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 52.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.

Affected products (as reported)

VendorProductVersions
clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions 0 – through 241114

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References