CVE-2024-10261: Paid Member Subscriptions RCE Vulnerability

CVE-2024-10261 Overview

CVE-2024-10261 affects the Paid Member Subscriptions plugin for WordPress, developed by Cozmoslabs. The plugin is marketed as "Effortless Memberships, Recurring Payments & Content Restriction" and is widely deployed on membership-driven sites. All versions up to and including 2.13.0 improperly validate user-supplied input before passing it to the do_shortcode function. Unauthenticated attackers can leverage this flaw to execute arbitrary shortcodes against the affected site. The vulnerability is classified under [CWE-94] (Improper Control of Generation of Code) and carries an EPSS probability of 1.233% at the 79th percentile.

Critical Impact
Unauthenticated remote attackers can trigger arbitrary shortcode execution on vulnerable WordPress sites, enabling content manipulation, information disclosure, or abuse of installed plugin shortcodes.

Affected Products

Cozmoslabs Paid Member Subscriptions plugin for WordPress, all versions through 2.13.0
WordPress sites with the Membership & Content Restriction – Paid Member Subscriptions plugin installed
Sites running additional plugins that register sensitive or privileged shortcodes

Discovery Timeline

2024-11-09 - CVE-2024-10261 published to the National Vulnerability Database
2025-01-29 - Last updated in the NVD database

Technical Details for CVE-2024-10261

Vulnerability Analysis

The Paid Member Subscriptions plugin exposes an action handler that accepts attacker-controlled input and forwards it to WordPress's do_shortcode function without proper validation. WordPress shortcodes are server-side macros that execute PHP code registered by the core, themes, or any installed plugin. When an unauthenticated request reaches the vulnerable code path, the supplied value is treated as a shortcode string and rendered. Attackers can invoke any registered shortcode, including those that expose private content, generate forms, or perform privileged operations defined by other plugins.

Root Cause

The root cause is missing input validation before code generation, as described by [CWE-94]. The plugin passes a user-controlled parameter directly to do_shortcode without applying an allowlist, capability check, or nonce verification. Because shortcode handlers are arbitrary PHP callbacks, the resulting behavior depends on which shortcodes are registered on the target site, broadening the potential impact beyond the plugin itself.

Attack Vector

Exploitation requires no authentication, no user interaction, and can be performed over the network against any reachable WordPress instance running the affected plugin. An attacker submits a crafted HTTP request to the vulnerable plugin action with a shortcode payload in the controlled parameter. The plugin renders the shortcode server-side, returning its output or performing its registered side effects. Because shortcode availability differs per site, attackers typically fingerprint installed plugins first to maximize impact. Technical details and indicators are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-10261

Indicators of Compromise

Unauthenticated POST or GET requests to admin-ajax.php or plugin endpoints carrying [shortcode] syntax in parameter values.
Web server logs showing repeated requests to Paid Member Subscriptions action handlers from a single IP enumerating shortcode names.
Unexpected rendered output containing data from privileged shortcodes (member lists, gated content) in HTTP response bodies.

Detection Strategies

Inspect HTTP request bodies and query strings for square-bracket shortcode patterns (e.g. [pms-*], [gravityform]) sent to plugin endpoints by unauthenticated clients.
Compare installed plugin version against 2.13.1 or later using a WordPress inventory script or wp plugin list.
Correlate plugin action invocations with originating IPs to identify scanning behavior associated with mass exploitation.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized SIEM and alert on shortcode patterns in unauthenticated requests.
Monitor outbound network connections from the web server for anomalies that could indicate shortcode-driven data exfiltration.
Track plugin file integrity using checksum monitoring to detect tampering after suspected exploitation.

How to Mitigate CVE-2024-10261

Immediate Actions Required

Update the Paid Member Subscriptions plugin to a version newer than 2.13.0 on every WordPress instance.
Audit web server access logs for prior exploitation attempts targeting the vulnerable plugin action since November 2024.
Review and remove any registered shortcodes from third-party plugins that expose sensitive data or privileged operations.

Patch Information

Cozmoslabs released a fix in the plugin repository. The corrective changes are visible in the WordPress Plugin Changeset 3182968. Administrators should upgrade through the WordPress admin dashboard or via wp-cli using wp plugin update paid-member-subscriptions.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated requests containing shortcode bracket syntax to plugin endpoints.
Temporarily deactivate the Paid Member Subscriptions plugin until the patched version is installed if immediate updates are not possible.
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible using server-level ACLs.

bash

# Configuration example
wp plugin update paid-member-subscriptions --version=2.13.1
wp plugin get paid-member-subscriptions --field=version