Skip to content
Noroxi

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions

paid-memberships-pro · plugin

Known security vulnerabilities for Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

1 critical · 11 exploitable without logging in · 4 with public exploit code · latest Nov 1, 2024

Closed on wordpress.org

Removed from the directory on Oct 17, 2024 · reason: author request. A closed component gets no more updates; installed copies keep running and their vulnerabilities stay open. Remove it or replace it with a maintained alternative.

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-37277unauthenticated≤ 3.0.4

    WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

    Critical 9.8

  • CVE-2024-32794unauthenticated · needs a click≤ 2.12.10

    WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2024-32793unauthenticated · needs a click≤ 2.12.10

    WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2023-6187subscriber+≤ 2.12.3

    Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

    High 8.8

  • CVE-2021-20678login required

    SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary S

    High 8.8

  • CVE-2024-37486high privilege≤ 3.0.5

    WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability

    High 7.2

  • CVE-2021-24979unauthenticated · needs a click→ 2.6.6

    Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2015-5532unauthenticated · needs a click

    Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote att

    Medium 6.1

  • CVE-2024-1407unauthenticated · needs a click≤ 2.12.10

    Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification

    Medium 5.4

  • CVE-2024-0624unauthenticated≤ 2.12.7

    Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

    Medium 5.3

  • CVE-2023-6855unauthenticated≤ 2.12.5

    Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

    Medium 5.3

  • CVE-2014-8801

    Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attac

    Medium 5.0

  • CVE-2024-3215unauthenticated≤ 3.0.1

    Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery

    Medium 4.3

  • CVE-2024-0588unauthenticated · needs a click≤ 2.12.10

    Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery

    Medium 4.3

  • CVE-2020-36754unauthenticated · needs a click→ 2.4.3

    Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory