WordPress CVEs

Description

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.

Affected WordPress components

• paid-memberships-pro Plugin · paid-memberships-pro
  Confirmed match Homeless
  Up to and including 2.12.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• strangerstudios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions — Up to and including 2.12.3
• strangerstudios paid_memberships_pro — Up to and including 2.12.3

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.3/includes/fields.php#L564 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.php Patch
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.php Patch
• www.paidmembershipspro.com https://www.paidmembershipspro.com/pmpro-update-2-12-4/ Product
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cve Patch, Third Party Advisory
• nvd.nist.gov Official NVD record