WP-Members Membership Plugin Vulnerability – Unprotected Storage of Potentially Sensitive Files – CVE-2024-2920 | WordPress Plugin Vulnerability Report 

Plugin Name: WP-Members Membership Plugin

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-members
  • Software Status: Active
  • Software Author: cbutlerjr
  • Software Downloads: 3,498,751
  • Active Installs: 60,000
  • Last Updated: May 10, 2024
  • Patched Versions:
  • Affected Versions: <=

Vulnerability Details:

  • Name: WP-Members Membership Plugin <=
  • Title: Unprotected Storage of Potentially Sensitive Files
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE: CVE-2024-2920
  • CVSS Score: 5.3
  • Publicly Published: April 25, 2024
  • Researcher: Tim Coen
  • Description: The WP-Members Membership Plugin is vulnerable to information exposure through the way it handles file uploads. All versions up to and including allow user-supplied files to be stored in a publicly accessible directory within wp-content, without any form of restrictions. This flaw makes it possible for unauthenticated attackers to access files uploaded by users, which could contain sensitive information.


The WP-Members Membership Plugin for WordPress has a vulnerability in versions up to and including that allows for unprotected storage of potentially sensitive files. This vulnerability has been patched in version

Detailed Overview:

àThis vulnerability, identified by researcher Tim Coen, poses a significant risk as it exposes sensitive user data to potential unauthorized access. The issue arises from the plugin’s handling of file uploads, which are stored in an unrestricted, publicly accessible directory. This could lead to the exposure of personal data, such as identification documents or private communications, uploaded by users as part of the membership registration process. The prompt update to version resolves this issue by implementing restrictions on the storage and accessibility of uploaded files.

Advice for Users:

  • Immediate Action: Update to version immediately to mitigate the vulnerability.
  • Check for Signs of Vulnerability: Review the wp-content directory for any unusual files that should not be publicly accessible and remove them.
  • Alternate Plugins: While the current vulnerability has been addressed, users may consider exploring other membership plugins that have historically shown robust security practices.
  • Stay Updated: Continuously monitor and update your WordPress plugins to protect against vulnerabilities.


The quick resolution of this vulnerability by the WP-Members plugin developers emphasizes the critical nature of timely software updates. To maintain the security of your WordPress site, it is essential that you install version or later of the WP-Members plugin. Doing so ensures that your site and its users' sensitive information remain protected from potential threats.


Detailed Report: 

In the fast-paced digital world, security often plays second fiddle to functionality for small business owners. Yet, the recent discovery of a significant vulnerability in the WP-Members Membership Plugin—a tool used by over 60,000 websites—underscores the dire consequences of neglecting this crucial aspect of website management. Dubbed CVE-2024-2920, this security flaw exposed sensitive user files to unauthorized access, reminding us all of the critical importance of regular software updates.

About the Plugin:

The WP-Members Membership Plugin is designed to simplify the management of member areas on WordPress sites. It's particularly popular among small businesses for its ease of use and functionality, offering tools for restricting access to content and managing user registrations. As of its last update on May 10, 2024, the plugin has been downloaded over 3.4 million times, highlighting its widespread use and the potential impact of any security issues.

Risks and Potential Impacts:

This type of vulnerability primarily risks the exposure of personal and sensitive data, which could include everything from personal identifiers to private communications among members. For businesses, such exposure not only breaches trust but could also lead to compliance issues under data protection regulations. Furthermore, once attackers have access to one part of your site, they could potentially exploit other vulnerabilities or plant malware.

Remediation Steps:

To address this vulnerability, the developers quickly released version, which introduces necessary security measures to restrict access to uploaded files. Here’s what you can do:

  1. Immediate Action: Update your plugin to version immediately via your WordPress dashboard.
  2. Check for Signs of Exposure: Review the contents of your wp-content directory for any unusual or unexpected files.
  3. Review and Restrict Access: Ensure that file permissions for the wp-content directory are correctly set to prevent unauthorized access.

Overview of Previous Vulnerabilities:

Since its inception, the WP-Members plugin has encountered various security issues, with eight vulnerabilities reported since 2014. This history not only emphasizes the importance of this specific update but also serves as a reminder that cybersecurity is an ongoing process, requiring regular reviews and updates.


For small business owners, managing a website’s security might seem overwhelming, especially with limited time and resources. However, the reality of today's digital landscape makes it imperative. Staying informed about the plugins your site uses, applying updates promptly, and using trusted security tools can mitigate risks significantly. Remember, the cost of managing security updates is minimal compared to the potential damage from a security breach.

By making website security a regular part of your business routine, you safeguard not just your data but also your reputation and the trust of your customers.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP-Members Membership Plugin Vulnerability – Unprotected Storage of Potentially Sensitive Files – CVE-2024-2920 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment