CVE-2024-0972

MEDIO 5.3CVE-2024-0972 · Published 06/06/2024 · updated 17/06/2026

En resumen

CVE-2024-0972 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a buddypress members only (membersonly).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.8% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
buddypress members only membersonly	`≤ 3.3.5`	No fix yet

Description

The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.

References

plugins.trac.wordpress.org/browser/buddypress-members-only/trunk/buddypress-members-only.php · Product
plugins.trac.wordpress.org/changeset
plugins.trac.wordpress.org/changeset
wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free