CVE-2024-11291: Paid Member Subscriptions Info Disclosure

CVE-2024-11291 Overview

CVE-2024-11291 affects the Paid Member Subscriptions plugin for WordPress, developed by Cozmoslabs. The plugin, marketed as Effortless Memberships, Recurring Payments & Content Restriction, contains a sensitive information exposure flaw in all versions up to and including 2.13.4. The vulnerability resides in how the plugin interacts with the WordPress core search feature. Unauthenticated attackers can extract content from posts that administrators restricted to higher-level roles such as logged-in members. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can read restricted membership content through the WordPress search feature, bypassing role-based access controls without authentication or user interaction.

Affected Products

Cozmoslabs Membership & Content Restriction – Paid Member Subscriptions plugin for WordPress
All versions up to and including 2.13.4
WordPress sites using the plugin's role-based content restriction features

Discovery Timeline

2024-12-18 - CVE-2024-11291 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11291

Vulnerability Analysis

The Paid Member Subscriptions plugin allows site owners to gate posts and pages behind membership roles. Restricted posts should only render for authenticated users holding the correct membership level. However, the plugin fails to filter these restricted posts from the WordPress core search index.

When an unauthenticated visitor issues a search query through the standard WordPress search endpoint, the search response returns excerpts and metadata from restricted posts. This exposes protected content without the attacker needing credentials, membership, or any interaction from a legitimate user.

The flaw is a broken access control condition rather than a code execution issue. The impact is confined to confidentiality of protected post content.

Root Cause

The plugin does not integrate its restriction logic with the WordPress search query filters such as pre_get_posts for unauthenticated visitors. Content restriction is enforced at render time on the single-post view, but the search results loop bypasses that enforcement. Restricted post titles, excerpts, and portions of body content therefore surface in search output.

Attack Vector

Exploitation requires only network access to the WordPress site and the ability to issue an HTTP GET request against the search endpoint. An attacker submits crafted keyword queries against /?s=<keyword> to enumerate restricted content. Repeated queries with varied keywords can be used to systematically extract information from members-only posts. No authentication, privileges, or user interaction are required. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-11291

Indicators of Compromise

Repeated unauthenticated GET requests to the WordPress search endpoint (/?s=) from a single source IP or narrow IP range
Search queries containing keywords that correspond to restricted content titles or member-only topics
Anomalous spikes in search traffic against sites running Paid Member Subscriptions <= 2.13.4
Web server access logs showing enumeration patterns such as sequential dictionary-style search terms

Detection Strategies

Inventory WordPress installations and identify sites running paid-member-subscriptions at version 2.13.4 or earlier
Correlate search endpoint access logs with the visibility of restricted post excerpts in HTTP responses
Deploy Web Application Firewall (WAF) rules that rate-limit and alert on high-volume unauthenticated search queries

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized analytics platform for query pattern analysis
Alert on unauthenticated sessions retrieving search result pages that reference posts marked as restricted in the plugin's database
Track plugin version drift across managed WordPress fleets to detect unpatched instances

How to Mitigate CVE-2024-11291

Immediate Actions Required

Upgrade the Paid Member Subscriptions plugin to a version later than 2.13.4 on all affected WordPress installations
Audit restricted content to determine whether any sensitive member-only material may have been exposed through search results
Review web server access logs for suspicious search query patterns predating the upgrade

Patch Information

Cozmoslabs addressed the issue in a plugin update tracked in the WordPress Plugin Changeset 3206206. Site operators should apply the fixed version through the WordPress admin plugin updater or by pulling the latest release from the WordPress plugin repository.

Workarounds

Temporarily disable the WordPress core search feature on affected sites until the plugin is patched
Use a pre_get_posts filter in a mu-plugin to exclude restricted post types and categories from unauthenticated search queries
Restrict search endpoint access with WAF rules that require authentication or challenge unauthenticated visitors
Move highly sensitive member-only content to protected post types that are excluded from search indexing

bash

# Example mu-plugin snippet to exclude restricted categories from unauthenticated search
# Place in wp-content/mu-plugins/pms-search-hardening.php
add_action('pre_get_posts', function($query) {
    if (!is_admin() && $query->is_search() && !is_user_logged_in()) {
        $query->set('category__not_in', [/* restricted category IDs */]);
    }
});