CVE-2024-2920

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
cbutlerjr	WP-Members Membership Plugin	<= 3.4.9.3

References

Timeline

Published: Apr 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-292006.5Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and t CVE-2024-292019.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation CVE-2024-292029.9JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template in CVE-2024-292036.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. CVE-2024-292049.8A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P CVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affe CVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the CVE-2024-292096.0A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an atta CVE-2024-29219.8Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t CVE-2024-292102.8A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its config