Skip to content
OpenAdvisories
High · 7.5 CVE-2024-37277 EUVD-2024-36553GHSA-29g9-48v7-9r7c

WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

Published Nov 1, 2024 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

Affected products

VendorProductAffectedFixed
Paid Memberships Pro Paid Memberships Pro ≤ 3.0.4 —

References