← Vulnerability feed

Vulnerability record · CVE-2024-37277 · published 1 November 2024

CVE-2024-37277: Strangerstudios paid memberships pro insecure direct object reference vulnerability

Strangerstudios · Paid Memberships Pro

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

9.8 CVSS 3.1 Critical EPSS 0.67% · top 50.0% CWE-639 · Insecure direct object reference
9.8CVSS 3.1 base score
0.67%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-4-insecure- Third Party Advisory

Track CVE-2024-37277 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-23488Paid Memberships Pro WordPress plugin unauthenticated SQL injectionThe Paid Memberships Pro WordPress plugin before version 2.9.8 is affected by an unauthenticated SQL injection in the 'code' parameter of the '/pmpro…EPSS 92%analysed9.8CVE-2021-25114Paid Memberships Pro unauthenticated SQL injection via discount_codeThe Paid Memberships Pro WordPress plugin before 2.6.7 fails to escape the discount_code parameter in a REST route that is reachable without authenti…EPSS 82%analysed8.8CVE-2023-39990Strangerstudios paid memberships pro missing authorization vulnerabilityMissing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.EPSS 0.48%8.8CVE-2024-32793Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.23%8.8CVE-2024-32794Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.25%8.8CVE-2023-6187Paid Memberships Pro WordPress plugin arbitrary file uploadThe Paid Memberships Pro plugin for WordPress fails to properly validate file types in the pmpro_paypalexpress_session_vars_for_user_fields function …EPSS 51%analysed8.8CVE-2023-0631Paid Memberships Pro WordPress plugin SQL injection via shortcodesThe Paid Memberships Pro WordPress plugin before 2.9.12 fails to prevent subscribers from rendering shortcodes that concatenate attributes directly i…EPSS 60%analysed8.8CVE-2021-20678Strangerstudios paid memberships pro sql injection vulnerabilitySQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL comman…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2024-37277), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.