CVE-2024-43240 CRITICAL

CVE-2024-43240: WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerability

Vendor Azzaroco
Product Ultimate Membership Pro
Weakness CWE-287 · Improper authentication
Published August 19, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

What the vulnerability does

01Description

Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

Explanation of Vulnerability in Simple Terms

02Summary

Ultimate Membership Pro versions 12.7 and earlier contain an authentication bypass vulnerability. An attacker can bypass login mechanisms without valid credentials, gaining unauthorized access to user accounts and administrative functions. The vulnerability affects confidentiality, integrity, and availability of the site. Update to a version newer than 12.7 immediately.

What an attacker can do

03Attacker Capabilities

Bypass login authentication and gain unauthorized access to user accounts and site administration.

Potential impact on your site

04Site Impact

Attackers can access member accounts, modify site data, and potentially take over the site without knowing passwords.

Conditions required to exploit

05Prerequisites

Network access only; no authentication, user interaction, or special configuration required.

Key dates

06Disclosure timeline

August 19, 2024 CVE published
April 28, 2026 Record updated