CVE-2024-10537: WP User Manager User Meta Key Enumeration Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - WP User Manager - User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration 2. Vulnerability Description: - Describes a data unauthorized access vulnerability in all versions of the WP User Manager plugin (including 2.9.11), caused by missing permission checks in the function. This allows attackers with Subscriber or higher privileges to enumerate user metadata. 3. Vulnerability Rating: - CVSS 3.1 Score: 4.3 (Medium) 4. Public Release Date: - November 22, 2024 5. Last Updated Date: - November 23, 2024 6. Researcher: - Tieu Pham Trong Nhan - TechlabCorp 7. Vulnerability ID: - CVE-2024-10537 8. Affected Versions: - <= 2.9.11 9. Fixed Version: - 2.9.12 10. Remediation Recommendation: - Upgrade to version 2.9.12 or higher. 11. Reference Links: - plugins.trac.wordpress.org 12. Vulnerability Details: - Provides detailed information about the vulnerability, including software type, software alias, whether it has been fixed, and remediation advice. 13. Copyright Information: - Includes copyright and licensing information, such as Defiant Inc. and MITRE Corporation copyright notices. 14. Vulnerability Database: - Offers the Wordfence Intelligence WordPress vulnerability database, completely free, with API access and query capabilities. 15. Notification Service: - Provides the Wordfence plugin, which can be installed on websites to immediately notify users if their site is affected by newly added vulnerabilities in the database. 16. API Access: - Offers free personal and commercial API access to the Wordfence Intelligence WordPress vulnerability database, along with free webhook integration to stay updated on the latest vulnerabilities. This information helps users understand and assess the risk of the vulnerability and take appropriate actions to protect their WordPress websites.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-10537: WP User Manager User Meta Key Enumeration Vulnerability