CVE-2024-11090

Medium

Published: 26 January 2025

Published

26 January 2025

Modified

30 January 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0009 24.8th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-11090 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Liquidweb Restrict Content. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Remediating the specific flaw in the Membership Plugin via patching directly prevents unauthenticated attackers from extracting sensitive data from restricted posts through the WordPress search feature.

AC-3 Access Enforcement good match

prevent

Enforcing approved authorizations for access to restricted posts ensures the search feature does not bypass role-based protections, blocking unauthorized exposure of sensitive information.

SI-15 Information Output Filtering good match

prevent

Filtering information output from search results based on user authorizations prevents the disclosure of sensitive data from higher-level restricted posts to unauthenticated attackers.

NVD Description

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data…

from posts that have been restricted to higher-level roles such as administrator.

Deeper analysisAI

CVE-2024-11090 is a sensitive information exposure vulnerability (CWE-200) in the Membership Plugin – Restrict Content for WordPress, affecting all versions up to and including 3.2.13. The flaw occurs via the WordPress core search feature, enabling the extraction of sensitive data from posts restricted to higher-level roles such as administrator.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Exploitation allows remote attackers with no privileges to access low-impact confidential data from protected posts, without affecting integrity or availability.

Mitigation details are available in the WordPress plugins trac changeset 3227065 at https://plugins.trac.wordpress.org/changeset/3227065/restrict-content, which addresses the issue. Further advisory information is provided by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/7615c391-ccb1-4990-bbfd-949782cc609a?source=cve.