Question 1

What exactly is the vulnerability in Paid Memberships Pro?

Accepted Answer

What exactly is the vulnerability in Paid Memberships Pro?

The vulnerability is an arbitrary file upload issue that exists because of insufficient validation of uploaded file types in the plugin's code. This allows attackers to bypass restrictions on allowed files and upload anything they want to the site's server. This exposes sites to serious compromise if malicious files like web shells are uploaded.

Question 2

How severe is this vulnerability?

Accepted Answer

How severe is this vulnerability?

This vulnerability is considered high severity with a CVSS score of 7.5. It allows attackers to potentially fully compromise vulnerable WordPress sites by uploading backdoor code or other malicious files. So it represents a very serious risk that required an immediate patch release by the plugin author once discovered.

Question 3

What versions of Paid Memberships Pro are affected?

Accepted Answer

What versions of Paid Memberships Pro are affected?

The vulnerability impacts all versions up to and including 2.12.3. Sites running any of those versions should update to 2.12.4 as soon as possible in order to patch this critical arbitrary file upload flaw.

Question 4

Who could exploit this vulnerability?

Accepted Answer

Who could exploit this vulnerability?

Any registered user role at or above Subscriber could potentially exploit this to upload malicious files. This includes customers who sign up for memberships. Attackers would just need a user account with those basic privileges to exploit the insufficient file validation.

Question 5

Does this affect all sites using Paid Memberships Pro?

Accepted Answer

Does this affect all sites using Paid Memberships Pro?

The vulnerability only applies to sites that have PayPal Express or 2Checkout enabled as the payment gateway for memberships. It also requires having custom user profile fields enabled in the plugin. So not every configuration is automatically vulnerable, but many are.

Question 6

Could this vulnerability lead to a site being hacked?

Accepted Answer

Could this vulnerability lead to a site being hacked?

Yes, the ability to upload any file to the server provides an initial foothold for attackers to fully compromise the site. Typical next steps would be uploading a web shell, giving the attacker remote access to execute additional code. So this vulnerability certainly enables serious site takeovers.

Question 7

Should I find an alternative to Paid Memberships Pro?

Accepted Answer

Should I find an alternative to Paid Memberships Pro?

The vulnerability has been patched in the latest version, so Paid Memberships Pro can still be safely used. However, if you are concerned, there are alternative paid membership plugins like MemberPress that offer similar functionality. But the key is keeping your chosen plugin updated.

Question 8

What should I do if I think my site was compromised?

Accepted Answer

What should I do if I think my site was compromised?

If you suspect your site was compromised through this vulnerability, take it offline immediately. You will then want to fully restore from backups before the attack occurred. It is also wise to scan for malware and change all passwords after restoring the site.

Question 9

How can I prevent vulnerabilities like this in the future?

Accepted Answer

How can I prevent vulnerabilities like this in the future?

Unfortunately vulnerabilities are discovered regularly in WordPress plugins. So the best way to prevent issues is having a managed WordPress security service that keeps plugins patched, monitors for threats, and alerts you of any relevant issues.

Question 10

Why is keeping WordPress and plugins updated so important?

Accepted Answer

Why is keeping WordPress and plugins updated so important?

The regular discovery of vulnerabilities like this illustrates why prompt updating is critical. Outdated plugins contain flaws that put sites at risk of compromise. So staying on top of updates is essential to lock down WordPress security and prevent attacks.

Paid Memberships Pro vulnerability

WordPress Plugin Vulnerability Report – Paid Memberships Pro – Authenticated (Subscriber+) Arbitrary File Upload – CVE-2023-6187

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy