CVE-2024-12919: Paid Member Subscriptions Auth Bypass Flaw

CVE-2024-12919 Overview

CVE-2024-12919 is an Authentication Bypass vulnerability affecting the Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress in all versions up to and including 2.13.7. The vulnerability exists within the pms_pb_payment_redirect_link function, which improperly uses user-controlled values supplied via the pms_payment_id parameter to authenticate users without performing additional identity validation. This flaw enables unauthenticated attackers who possess knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.

Critical Impact
Unauthenticated attackers can bypass authentication and gain unauthorized access to any user account that has completed a purchase, potentially including administrator accounts with full site control.

Affected Products

Cozmoslabs Paid Membership Subscriptions plugin for WordPress versions up to and including 2.13.7
WordPress sites utilizing Membership & Content Restriction - Paid Member Subscriptions
Any e-commerce or membership site using the affected plugin with active payment processing

Discovery Timeline

2025-01-14 - CVE-2024-12919 published to NVD
2025-01-22 - Last updated in NVD database

Technical Details for CVE-2024-12919

Vulnerability Analysis

This authentication bypass vulnerability stems from a fundamental flaw in how the plugin validates user identity during the payment redirect flow. The pms_pb_payment_redirect_link function accepts a pms_payment_id parameter that is entirely user-controlled and uses this value to establish an authenticated session without verifying that the requesting party is actually the legitimate owner of that payment record.

The vulnerability is particularly severe because it requires no prior authentication or elevated privileges to exploit. An attacker only needs to obtain or guess a valid payment ID to impersonate any user who has made a purchase. This could include site administrators who may have tested the payment system, giving attackers full control over the WordPress installation.

Root Cause

The root cause is a classic CWE-287 (Improper Authentication) issue where the authentication mechanism relies solely on a predictable or enumerable identifier (payment ID) rather than implementing proper identity verification. The function trusts the pms_payment_id parameter without validating that the request originates from the actual user associated with that payment. This missing verification step creates a direct path from knowing a payment ID to obtaining authenticated access.

Attack Vector

The attack exploits the network-accessible payment redirect functionality. An attacker can craft malicious requests to the vulnerable endpoint with different pms_payment_id values. Payment IDs in many systems follow predictable sequential patterns, making enumeration attacks feasible. Once a valid payment ID is identified, the attacker sends a request to the payment redirect function, which authenticates them as the user associated with that payment without any additional verification.

The attack requires no user interaction and can be performed entirely remotely. Because payment IDs are often numeric and sequential, attackers can automate the enumeration process to discover valid IDs and subsequently hijack multiple user accounts.

Detection Methods for CVE-2024-12919

Indicators of Compromise

Unusual login activity for user accounts that previously made purchases
Multiple authentication events originating from unexpected IP addresses or geolocations
Suspicious requests to payment redirect endpoints with varying pms_payment_id values
Rapid sequential requests to the plugin's payment handling functions suggesting enumeration attempts

Detection Strategies

Monitor web application logs for requests to pms_pb_payment_redirect_link with unusual patterns
Implement rate limiting on payment-related endpoints to detect enumeration attempts
Review authentication logs for sessions initiated via payment redirect that lack corresponding user-initiated activity
Deploy web application firewall rules to detect parameter tampering on payment ID fields

Monitoring Recommendations

Enable detailed logging for all authentication events within WordPress
Configure alerts for multiple failed or unusual authentication attempts from single IP addresses
Monitor for automated scanning patterns targeting plugin-specific endpoints
Implement user behavior analytics to detect account takeover scenarios

How to Mitigate CVE-2024-12919

Immediate Actions Required

Update the Paid Membership Subscriptions plugin to version 2.13.8 or later immediately
Audit recent authentication logs for any signs of exploitation
Force password resets for all users, particularly those with administrative privileges who have made purchases
Review user accounts for unauthorized changes or suspicious activity
Consider temporarily disabling the plugin if immediate update is not possible

Patch Information

Cozmoslabs has released a security patch addressing this vulnerability. The fix is available in the WordPress Plugin Changeset. Site administrators should update to the latest version through the WordPress plugin update mechanism. The patch implements proper identity verification in the pms_pb_payment_redirect_link function to ensure that payment ID parameters cannot be used to authenticate arbitrary users.

Workarounds

If immediate patching is not possible, consider temporarily disabling the plugin until the update can be applied
Implement web application firewall rules to block or scrutinize requests containing the pms_payment_id parameter
Restrict access to payment redirect endpoints at the server level using IP allowlisting where feasible
Enable two-factor authentication for all user accounts to provide an additional layer of protection against account takeover

bash

# WordPress CLI command to update the plugin
wp plugin update paid-member-subscriptions

# Verify the installed version after update
wp plugin get paid-member-subscriptions --field=version