Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| strangerstudios | Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions | up to 2.12.3 | — | No fix listed | CNA |
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Vendorstrangerstudios Affected up to 2.12.3 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* | up to 2.12.3 | Vulnerable | strangerstudios |
- cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* Versions up to 2.12.3 Vulnerable ·strangerstudios
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6187
- 2026-10-03 Alias added: GHSA-wwhh-cm65-x8qq
References
Patch 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cve
- https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.php
- https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.php
More strangerstudios Paid Memberships Pro vulnerabilities
- TI-2023-09323 SQL injection in Paid Memberships Pro WordPress Plugin CVSS 3.1CRITICAL 9.8
- TI-2021-07392 Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2023-00598 Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.8
- TI-2022-04426 Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 6.1
- TI-2024-01197 Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi CVSS 3.1MEDIUM 6.5
- TI-2024-01196 Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure CVSS 3.1MEDIUM 4.9
Sources
- CVE-2023-6187 · CVE Program
- CVE-2023-6187 · NVD
- FIRST EPSS
- GHSA-wwhh-cm65-x8qq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences