CVE-2024-11008: WordPress Members Plugin Information Disclosure

CVE-2024-11008 Overview

The Members – Membership & User Role Editor plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 3.2.10. The flaw resides in how the plugin interacts with the WordPress core search feature. Unauthenticated attackers can extract sensitive content from posts that administrators restricted to higher-level roles. The vulnerability is tracked under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated remote attackers can read content from posts restricted to administrator or other privileged roles by leveraging the WordPress core search feature.

Affected Products

WordPress plugin: Members – Membership & User Role Editor
Versions: all releases up to and including 3.2.10
Fixed version: 3.2.11 and later

Discovery Timeline

2024-12-11 - CVE-2024-11008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11008

Vulnerability Analysis

The Members plugin provides role-based content restrictions that allow administrators to limit posts to specific user roles. The plugin enforces restrictions on direct post views but does not filter restricted posts from WordPress core search results. When an unauthenticated visitor issues a search query, the WordPress search endpoint returns post excerpts and matched content from restricted posts. Attackers can iteratively query search terms to reconstruct portions of protected content without ever authenticating. The impact is limited to confidentiality; the vulnerability does not allow modification of data or disruption of service.

Root Cause

The root cause is missing authorization on the search results pipeline. The plugin hooks into single post display and template rendering to enforce role checks, but the WordPress core search query (WP_Query with s parameter) is not filtered to exclude posts whose post_status or meta indicates a restricted access level. Content excerpts, titles, and matched text bypass the intended access control layer.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the target site. An attacker sends HTTP GET requests to the site's search endpoint, such as https://target.example/?s=<keyword>, and parses the returned excerpts. By varying keywords, an attacker can enumerate content from restricted posts. Refer to the Wordfence vulnerability report for additional technical context.

// No verified proof-of-concept code is published for this issue.
// Exploitation reduces to standard WordPress search requests against the target site.

Detection Methods for CVE-2024-11008

Indicators of Compromise

High volume of unauthenticated GET requests to /?s= or /search/ endpoints from a single source IP.
Sequential search queries iterating dictionary terms or terms matching known restricted post topics.
Search requests returning HTTP 200 responses that reference post slugs marked as restricted in the Members plugin configuration.

Detection Strategies

Inventory WordPress installations and identify sites running the Members plugin at version 3.2.10 or earlier.
Review web access logs for anomalous search query patterns preceding unauthorized disclosure incidents.
Correlate search endpoint activity with content that should be role-restricted using web application firewall (WAF) telemetry.

Monitoring Recommendations

Ingest WordPress access logs into a centralized logging or SIEM platform and alert on search-endpoint enumeration behavior.
Monitor plugin versions across managed WordPress fleets and flag installations below 3.2.11.
Track outbound content in search responses for terms known to appear only in restricted posts.

How to Mitigate CVE-2024-11008

Immediate Actions Required

Update the Members – Membership & User Role Editor plugin to version 3.2.11 or later immediately.
Audit posts that were marked as role-restricted while the vulnerable version was deployed and rotate any secrets referenced in those posts.
Review web access logs for search enumeration activity dating back to the plugin's installation.

Patch Information

The vendor addressed the issue in the plugin changeset published to the WordPress plugin repository. See the WordPress Plugin Changeset 3199682 for the code changes that filter restricted posts from search queries. Administrators should install version 3.2.11 or newer through the WordPress plugin updater.

Workarounds

Disable the WordPress core search feature on affected sites until the patch is applied, for example by removing the search widget and returning empty results from the pre_get_posts hook.
Move highly sensitive content out of WordPress posts and into a system with stronger access control until remediation is complete.
Deploy WAF rules that block unauthenticated requests to /?s= containing keywords specific to restricted content.

bash

# Example: exclude restricted posts from search via a mu-plugin filter
# Place in wp-content/mu-plugins/restrict-search.php
add_action('pre_get_posts', function($query) {
    if (!is_admin() && $query->is_search() && !is_user_logged_in()) {
        $query->set('post__not_in', get_restricted_post_ids());
    }
});