High severity · published Dec 17, 2024
CVE-2024-8326
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions · clavaque
through 241114 · source: vendor
Affected product
SE
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
clavaque
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8326
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets-in.inc.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets.inc.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3188157/
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3208315/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/410d4ab0-22dd-4993-afbf-ae6193b70977?source=cve
More from s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
9.8
CVE-2026-1994
s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
8.8
CVE-2026-19804
s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
6.4
CVE-2026-109972
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
6.4
CVE-2025-13732
s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.1
CVE-2024-11376
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting