← Vulnerability feed

Vulnerability record · CVE-2024-32793 · published 24 April 2024

CVE-2024-32793: Strangerstudios paid memberships pro cross-site request forgery vulnerability

Strangerstudios · Paid Memberships Pro

Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

8.8 CVSS 3.1 High EPSS 0.23% · top 87.2% CWE-352 · Cross-site request forgery
8.8CVSS 3.1 base score
0.23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-s Third Party Advisory
https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-s Third Party Advisory

Track CVE-2024-32793 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-37277Strangerstudios paid memberships pro insecure direct object reference vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACL…EPSS 0.67%9.8CVE-2023-23488Paid Memberships Pro WordPress plugin unauthenticated SQL injectionThe Paid Memberships Pro WordPress plugin before version 2.9.8 is affected by an unauthenticated SQL injection in the 'code' parameter of the '/pmpro…EPSS 92%analysed9.8CVE-2021-25114Paid Memberships Pro unauthenticated SQL injection via discount_codeThe Paid Memberships Pro WordPress plugin before 2.6.7 fails to escape the discount_code parameter in a REST route that is reachable without authenti…EPSS 82%analysed8.8CVE-2023-39990Strangerstudios paid memberships pro missing authorization vulnerabilityMissing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.EPSS 0.48%8.8CVE-2024-32794Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.25%8.8CVE-2023-6187Paid Memberships Pro WordPress plugin arbitrary file uploadThe Paid Memberships Pro plugin for WordPress fails to properly validate file types in the pmpro_paypalexpress_session_vars_for_user_fields function …EPSS 51%analysed8.8CVE-2023-0631Paid Memberships Pro WordPress plugin SQL injection via shortcodesThe Paid Memberships Pro WordPress plugin before 2.9.12 fails to prevent subscribers from rendering shortcodes that concatenate attributes directly i…EPSS 60%analysed8.8CVE-2021-20678Strangerstudios paid memberships pro sql injection vulnerabilitySQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL comman…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2024-32793), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.