PatchTheCVECVE-2024-1407: The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress i
CVE-2024-1407 is a medium-severity flaw (CVSS 5.4) affecting paid memberships pro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performi
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2024-06-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-1407?
paid memberships pro: upgrade to 3.0. Exact commands for each OS are on this page.
Is CVE-2024-1407 being exploited?
CVE-2024-1407 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-1407 affect?
CVE-2024-1407 affects paid memberships pro. Severity is medium (CVSS 5.4). The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonc
How urgent is CVE-2024-1407?
Priority 22/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2024-3215 MEDIUM 5.3 UPGRADE The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress i
- CVE-2024-37486 HIGH 7.6 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Mem
- CVE-2024-37277 HIGH 7.5 UPGRADE Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functi
- CVE-2024-32794 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pr
- CVE-2024-32793 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pr