CVE-2024-1407: Paid Memberships Pro CSRF Vulnerability

CVE-2024-1407 Overview

CVE-2024-1407 is a Cross-Site Request Forgery (CSRF) vulnerability in the Paid Memberships Pro plugin for WordPress. The flaw affects all plugin versions up to and including 2.12.10. The root cause is missing or incorrect nonce validation on multiple plugin functions, classified as [CWE-352]. Unauthenticated attackers can trick an authenticated user into visiting a crafted link to subscribe, modify, or cancel that user's membership. The vendor strangerstudios addressed the issue in the subsequent plugin release.

Critical Impact
Attackers can manipulate WordPress user memberships without authentication by tricking a logged-in user into clicking a malicious link, resulting in unauthorized subscription changes.

Affected Products

Paid Memberships Pro plugin for WordPress, versions up to and including 2.12.10
Vendor: strangerstudios
CPE: cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-06-19 - CVE-2024-1407 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1407

Vulnerability Analysis

The vulnerability resides in multiple functions within the Paid Memberships Pro plugin, specifically in includes/functions.php and related handlers. These functions perform state-changing operations on user memberships without validating a WordPress nonce token or by using nonce checks incorrectly. WordPress nonces are the primary mechanism to bind a request to a user session and prevent forged cross-origin requests.

Because the affected endpoints accept requests that lack a valid _wpnonce, an attacker-controlled page can submit membership actions on behalf of an authenticated victim. The impact is limited to membership state changes, so confidentiality is not directly affected, but integrity and availability of a user's membership record are.

Root Cause

The root cause is absent or incorrect application of wp_verify_nonce() and check_admin_referer() on membership handling functions in versions through 2.12.10. Without a validated request token, the plugin cannot distinguish legitimate user-initiated actions from forged requests originating from third-party origins.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page containing a hidden form or image tag that issues a request to the vulnerable WordPress site. When an authenticated Paid Memberships Pro user visits the page or clicks the link, their browser transmits authentication cookies alongside the forged request. The plugin processes the request as if the user initiated it and applies the requested subscription, modification, or cancellation.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Analysis and the vendor patches in GitHub Pull Request #2839 and GitHub Pull Request #2893 for technical remediation details.

Detection Methods for CVE-2024-1407

Indicators of Compromise

Unexpected membership subscription, modification, or cancellation events tied to user accounts that did not initiate the change.
HTTP POST requests to Paid Memberships Pro endpoints with Referer or Origin headers pointing to external domains.
Membership state changes occurring in close temporal proximity to a user visiting an untrusted external link.

Detection Strategies

Inspect WordPress access logs for state-changing requests to Paid Memberships Pro URLs that lack a _wpnonce parameter.
Correlate membership change events in the plugin's audit tables with the originating Referer header captured by the web server.
Alert on anomalous spikes in membership cancellations or level changes tied to a single traffic source.

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress front-end and retain logs for retrospective analysis.
Monitor plugin update status across all managed WordPress instances to confirm the fixed version is deployed.
Track outbound-referrer patterns preceding membership modifications to identify potential CSRF landing pages.

How to Mitigate CVE-2024-1407

Immediate Actions Required

Update the Paid Memberships Pro plugin to a version later than 2.12.10 as published in WordPress Changeset #3058329.
Audit membership change logs since installation of any vulnerable version and revert unauthorized changes.
Notify site users to log out of active sessions after the patch is applied.

Patch Information

The vendor strangerstudios fixed the vulnerability in the release following 2.12.10. The fix adds proper nonce validation to the affected functions. Review the code changes in GitHub Pull Request #2839, GitHub Pull Request #2893, and the corresponding WordPress Plugin Function File.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to Paid Memberships Pro endpoints when the _wpnonce parameter is missing or the Origin/Referer header does not match the site domain.
Restrict administrative and membership-management URLs to trusted IP ranges where feasible.
Disable the plugin until the patched version is installed if immediate updates are not possible.

bash

# Example WAF rule concept: block cross-origin POSTs to plugin endpoints
# SecRule REQUEST_URI "@contains /?pmpro_" \
#   "chain,phase:2,deny,status:403,id:1407001,msg:'PMPro CSRF block'"
# SecRule &REQUEST_HEADERS:Referer "@eq 0"