CVE-2024-12919
Auth Bypass in Cozmoslabs Membership \& Content Restriction - Paid Member Subscriptions ≤ 2.13.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-12919 is a critical-severity Improper Authentication (CWE-287) vulnerability in Cozmoslabs Membership \& Content Restriction - Paid Member Subscriptions. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-12919 is an authentication bypass vulnerability in the Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress, affecting all versions up to and including 2.13.7. The flaw occurs in the pms_pb_payment_redirect_link function, which authenticates users based solely on a user-controlled value from the 'pms_payment_id' parameter without performing any further identity validation.
Unauthenticated attackers with knowledge of a valid payment ID can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows them to log in as any user who has made a purchase on the targeted site, potentially granting access to sensitive data and privileged actions. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-287 (Improper Authentication).
Mitigation details are provided in the plugin's WordPress trac changeset 3214706 at https://plugins.trac.wordpress.org/changeset/3214706/paid-member-subscriptions, which includes the patch. Additional threat intelligence is available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a4fa4d-a7d2-4890-b0f5-5fe69bc5e7ac?source=cve. Security practitioners should update to a patched version beyond 2.13.7 immediately.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51188
Vulnerability Data
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied…
more
via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Enforces access only after approved authorizations, which presupposes correct authentication has occurred.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.
A.8.26 explicitly requires identifying and addressing authentication-related requirements (including level of trust in identity via 8.5 and 5.17) as part of application development or acquisition, which prevents a slice of CWE-287 but leaves the dominant sufficiency-of-proof aspects (IA-2/IA-5) and many implementation defects untouched.
A.8.27 mandates security-by-design principles (least privilege, default-deny, never-trust/always-verify, MFA, end-to-end encryption of requests, distrust-external-input, secure session control, and explicit authentication/authorization in every layer), which directly stops most improper-authentication flaws from being exploitable; the bounded remainder is insufficient-proof cases that live only in the strength or correctness of the credential itself (IA-5/IA-2 territory).
A.8.5 directly mandates appropriate-strength authentication techniques, MFA for critical systems, protected log-on procedures, brute-force resistance, no cleartext passwords/transmission, and session controls that stop exploitation of insufficient proof of identity; the bounded remainder is cases where the chosen technique itself is flawed or insufficiently implemented (e.g. weak biometrics without fallback).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.