Security Resilience

CVE-2024-1287

Strangerstudios Paid Memberships Pro ≤ 1.2.6

Public PoC
Published
30 July 2024
Modified
22 August 2025
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0052 43th percentile
Risk Priority 52 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-1287 is a medium-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Strangerstudios Paid Memberships Pro. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-23 (Data Mining Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.

CWE(s)
CWE-202

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1010 Application Window Discovery Discovery
Adversaries may attempt to get a listing of open application windows.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-1407Same product: Strangerstudios Paid Memberships Pro
CVE-2024-32794Same product: Strangerstudios Paid Memberships Pro
CVE-2024-3215Same product: Strangerstudios Paid Memberships Pro
CVE-2024-32793Same product: Strangerstudios Paid Memberships Pro
CVE-2024-0624Same product: Strangerstudios Paid Memberships Pro
CVE-2024-0588Same product: Strangerstudios Paid Memberships Pro
CVE-2024-37277Same product: Strangerstudios Paid Memberships Pro
CVE-2023-23488Same product: Strangerstudios Paid Memberships Pro
CVE-2023-0631Same product: Strangerstudios Paid Memberships Pro
CVE-2024-37486Same product: Strangerstudios Paid Memberships Pro

Affected Assets

strangerstudios
paid memberships pro
≤ 1.2.6

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-23 Data Mining Protection good match

AC-23 directly requires mechanisms to protect against unauthorized data mining and inference from statistical queries that would expose sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-03 partial match
blocks

Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.

PR.AA-05 partial match
blocks

Least-privilege query permissions directly limit the data an attacker can request or infer.

PR.DS-10 partial match
blocks

Protecting data-in-use reduces what remains available for inference via queries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.12 Classification of information partial match
degrades

Classification helps identify sensitive data that must be protected from inference attacks.

A.5.15 Access control partial match
blocks

A.5.15 defines governance, policies, requirements and rules for access control (including need-to-know and classification consistency) but does not itself enforce, implement or act on those rules to stop statistical inference from data queries; per the owner's labeling rule, this is a dependency for other controls (e.g. actual access enforcement or DLP) rather than a prevention effect.

A.5.18 Access rights partial match
blocks

A.5.18 governs the provisioning, review, and revocation of authorized access rights; it has no bearing on whether an attacker can statistically infer confidential information from data queries, which is a disclosure weakness unrelated to access-right decisions.

A.8.11 Data masking partial match
blocks

Data masking prevents inference by obscuring sensitive values returned in query results.

A.8.12 Data leakage prevention partial match
finds

DLP can detect and block queries or result sets that risk exposing sensitive information.

A.8.15 Logging partial match
finds

Logging query activity supports detection of inference attempts after the fact.

References