CVE-2024-32728 MEDIUM

CVE-2024-32728: WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Cozmoslabs
Product Paid Member Subscriptions
Weakness CWE-352 · CSRF
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.11.0.

Explanation of Vulnerability in Simple Terms

02Summary

Paid Member Subscriptions for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker can modify site settings or user data if a logged-in administrator or user visits their crafted page. Update to a version newer than 2.11.0.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions (like changing settings or user data) on behalf of a logged-in site user.

Potential impact on your site

04Site Impact

Attackers can trick logged-in admins or users into unwittingly changing plugin settings or account data.

Conditions required to exploit

05Prerequisites

Victim must be logged in and click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-13422 HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers CVE-2026-15080 Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 CVE-2022-47150 WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2026-57759 WordPress ProfileGrid plugin <= 5.9.9.7 - CSRF to Account Takeover vulnerability CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update