CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Explanation of Vulnerability in Simple Terms
ProfilePress versions up to 4.13.2 expose sensitive user information without proper access controls. An attacker on the network can retrieve confidential data such as user details, email addresses, or membership information without authentication. This affects all sites running the vulnerable plugin version. Update to a version newer than 4.13.2 to resolve the issue.
What an attacker can do
Read sensitive user data including email addresses, membership status, and profile information without logging in.
Potential impact on your site
User email addresses, membership details, and profile data are exposed to anyone on the internet.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
