CVE-2024-0972: BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-06 · updated 2026-06-17
Weakness: CWE-284

Description

The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.

Affected products

zhuyi BuddyPress Members Only: through 3.3.5

References

https://plugins.trac.wordpress.org/browser/buddypress-members-only/trunk/buddypress-members-only.php#L682
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3122096%40buddypress-members-only&new=3122096%40buddypress-members-only&sfp_email=&sfph_mail=
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3128839%40buddypress-members-only&new=3128839%40buddypress-members-only&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52?source=cve
https://plugins.trac.wordpress.org/browser/buddypress-members-only/trunk/buddypress-members-only.php#L682
https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52?source=cve

Get alerted when CVE-2024-0972 or the next vulnerability affects your stack