CVE-2024-11290: Member Access Plugin Information Disclosure

CVE-2024-11290 Overview

The Member Access plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 1.1.6. The flaw resides in how the plugin interacts with the WordPress core search feature. Unauthenticated attackers can query the search endpoint to extract content from posts restricted to higher-privilege roles such as administrator. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact

Unauthenticated attackers can bypass role-based access restrictions and retrieve sensitive post content intended only for administrators or other privileged roles.

Affected Products

• Member Access plugin for WordPress, versions up to and including 1.1.6
• WordPress sites using the plugin to restrict post visibility by user role
• All deployments regardless of underlying WordPress core version

Discovery Timeline

• 2025-01-07 - CVE-2024-11290 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11290

Vulnerability Analysis

The Member Access plugin enforces role-based access control on individual WordPress posts, hiding restricted content from unauthorized visitors on the front end. The plugin's access checks do not extend to the WordPress core search subsystem. As a result, search queries return excerpts and content from posts that should be hidden. An unauthenticated visitor can craft search requests against the site to enumerate and read restricted material.

The issue is limited to confidentiality. Attackers cannot modify content or disrupt availability through this flaw. However, exposed data may include administrative notes, internal announcements, or unpublished editorial material stored in restricted posts.

Root Cause

The vulnerability stems from incomplete authorization enforcement. The plugin applies visibility checks to standard page and post rendering paths but omits filters on the search query results. WordPress core search runs a WP_Query against published posts without consulting the plugin's role-based restriction logic. Restricted post titles, excerpts, and content are returned in search results to any visitor.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues a GET request to the search endpoint, for example https://target.example/?s=keyword, using terms likely to appear in restricted posts. The server returns matching entries including those the plugin should have gated. No authentication, user interaction, or elevated privileges are required. Attackers can automate keyword sweeps to systematically extract restricted content. See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2024-11290

Indicators of Compromise

• Repeated anonymous GET requests to /?s= with varying keywords from the same source IP
• Web server logs showing high-volume search queries preceding scraping activity
• Search referrers or user agents associated with automated crawlers hitting non-public content titles

Detection Strategies

• Inventory WordPress installations to identify sites running the Member Access plugin at version 1.1.6 or earlier
• Compare access logs for search endpoint requests against expected user behavior baselines
• Correlate search response payload sizes with the presence of restricted post identifiers

Monitoring Recommendations

• Enable WordPress access logging and forward search endpoint traffic to a centralized log platform for review
• Alert on unauthenticated search requests that return content matching restricted post IDs
• Track plugin version drift across managed WordPress fleets to detect unpatched instances

How to Mitigate CVE-2024-11290

Immediate Actions Required

• Identify all WordPress sites running the Member Access plugin and confirm the installed version
• Restrict or disable the plugin on affected sites until a patched release is applied
• Review any content stored in restricted posts and rotate or redact secrets that may have been exposed

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Site administrators should monitor the Member Access plugin page on WordPress.org for an update that addresses the search filter bypass and apply it as soon as it becomes available.

Workarounds

• Disable the WordPress core search feature on affected sites by removing the search widget and returning empty results from a pre_get_posts filter that excludes restricted post types
• Move highly sensitive content out of restricted posts and into a separate authenticated system until a patch is available
• Deploy a web application firewall rule to block unauthenticated requests to the search endpoint or rate-limit repeated queries

# Example pre_get_posts filter to exclude restricted posts from search results
# Add to the active theme's functions.php
add_action('pre_get_posts', function($query) {
    if (!is_admin() && $query->is_search() && !is_user_logged_in()) {
        $query->set('post__not_in', get_option('member_access_restricted_ids', []));
    }
});