CVE-2024-11291

Executive Summary

CVE-2024-11291 is a Sensitive Information Exposure vulnerability affecting the Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction WordPress plugin, versions up to and including 2.13.4. The flaw resides in how the plugin interacts with the WordPress core search feature, allowing unauthenticated attackers to extract sensitive data from posts that should be restricted to higher-level roles (e.g., logged-in users). This is a WordPress ecosystem issue, not a server misconfiguration.

The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or proof-of-concept is available, but the risk is real for sites using the plugin to protect premium content.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are not using modified or pirated versions. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated attackers to read restricted post content via the WordPress search feature. While the impact is limited to confidentiality, the ease of exploitation (no authentication, no user interaction) makes it a realistic threat for sites with sensitive membership content.

Deep Dive & Mechanics

The vulnerability arises from improper handling of search results in the WordPress core search feature when the Paid Membership Subscriptions plugin is active. The plugin is designed to restrict access to certain posts based on user roles (e.g., subscribers, premium members). However, the plugin fails to filter out restricted posts from the WordPress search index.

Root Cause: The plugin does not hook into the pre_get_posts filter or modify the search query to exclude posts that require higher-level roles. As a result, when an unauthenticated user performs a search, WordPress returns all matching posts, including those that should be hidden. The post titles, excerpts, and sometimes full content are exposed in search results.

Attack Vector: An attacker can craft a search query (e.g., /?s=premium+content) to enumerate restricted posts. The search results page will display snippets of the restricted content, potentially revealing sensitive information such as membership-only articles, pricing details, or private data.

Affected Component: The plugin's integration with the WordPress search functionality. Specifically, the lack of a filter to exclude restricted posts from search results.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior and the expected fix.

Vulnerable Code (Conceptual): The plugin likely uses a custom post type or meta keys to mark posts as restricted. However, it does not modify the search query to exclude these posts.

// No filter added to pre_get_posts to exclude restricted posts
add_action('pre_get_posts', 'pms_exclude_restricted_from_search');
function pms_exclude_restricted_from_search($query) {
    if ($query->is_search && !is_user_logged_in()) {
        // Missing: exclude posts with 'pms_restricted' meta key
    }
}

Expected Patched Code: A patch would add a filter to pre_get_posts to exclude posts that have the restriction meta key when the user is not logged in.

add_action('pre_get_posts', 'pms_exclude_restricted_from_search');
function pms_exclude_restricted_from_search($query) {
    if ($query->is_search && !is_user_logged_in()) {
        $meta_query = array(
            array(
                'key' => 'pms_restricted',
                'compare' => 'NOT EXISTS'
            )
        );
        $query->set('meta_query', $meta_query);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Paid Membership Subscriptions plugin (version <= 2.13.4) installed and active.
• At least one post restricted to logged-in users (e.g., a premium article).

Exploitation Steps:

1. Identify the target: Find a WordPress site using the plugin (e.g., via Shodan dorks or WPScan).
2. Craft a search query: Use the WordPress search feature to look for keywords likely to appear in restricted posts.

   https://target.com/?s=premium+content
   

3. Analyze search results: The search results page will display excerpts from restricted posts, even for unauthenticated users.
4. Extract sensitive data: Use automated tools to enumerate all searchable terms and collect exposed content.

Example cURL command:

curl -s "https://target.com/?s=confidential" | grep -oP '(?<=<article).*?(?=</article>)'

Blue Team (Detection & Hardening)

Detection:

• Monitor search queries for unusual patterns (e.g., repeated searches for common restricted terms).
• Look for unauthenticated requests to /?s= that return content from restricted posts.

Hardening:

• Immediate: Disable the WordPress search feature temporarily if the plugin is critical.
• Short-term: Apply a virtual patch using a Web Application Firewall (WAF) to block search requests from unauthenticated users.
• Long-term: Wait for the vendor to release a patch and update the plugin.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/\?s=" "id:1001,phase:1,deny,status:403,msg:'Blocked unauthenticated search'"

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /?s= with no authentication cookies.
  • Search queries containing terms like "premium", "members", "restricted", or other membership-related keywords.
• Host:
  • WordPress search logs showing unauthenticated users accessing restricted post excerpts.
  • Plugin files unchanged (no patch applied).
• File:
  • No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2024_11291_WordPress_Sensitive_Info_Exposure {
    meta:
        description = "Detects unauthenticated search requests targeting restricted posts in Paid Membership Subscriptions plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-11291"
    strings:
        $search_pattern = "/?s="
        $restricted_keyword = "premium" nocase
        $restricted_keyword2 = "members" nocase
    condition:
        $search_pattern and ($restricted_keyword or $restricted_keyword2)
}

Sigma Rule

title: Unauthenticated Search for Restricted Content
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated HTTP requests to WordPress search that may be exploiting CVE-2024-11291
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '?s='
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate search queries from logged-in users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11291 - Unauthenticated WordPress Search for Restricted Content"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"?s="; http.user_agent; content:!"WordPress"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WordPress search feature for unauthenticated users by adding the following code to your theme's functions.php:

   add_action('init', 'disable_search_for_guests');
   function disable_search_for_guests() {
       if (!is_user_logged_in()) {
           add_filter('posts_search', '__return_empty_string');
       }
   }
   

2. Use a WAF to block search requests from unauthenticated IPs.
3. Monitor logs for suspicious search activity.

Long-term Fix:

• Update the plugin once a patched version is released by the vendor.
• Consider alternative plugins if the vendor does not provide a timely patch.

Workaround:

• Restrict search functionality to logged-in users only via a plugin like "Search Exclude" or custom code.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.