{"id":"CVE-2024-0687","state":"PUBLISHED","title":"Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure","description":"The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API.","publishedAt":"2024-03-13T15:27:25.636Z","updatedAt":"2026-04-08T17:33:33.852Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"Wordfence"},"assigner":"Wordfence","products":["intoxstudio Restrict User Access – Ultimate Membership & Content Protection"],"affected":[{"vendor":"intoxstudio","product":"Restrict User Access – Ultimate Membership & Content Protection","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.5","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/f67684cd-3e0f-48bb-967a-16ea2b027843?source=cve","https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037773%40restrict-user-access%2Ftrunk&old=3010745%40restrict-user-access%2Ftrunk&sfp_email=&sfph_mail="],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0687.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-0687","state":"PUBLISHED","datePublished":"2024-03-13T15:27:25.636Z","dateUpdated":"2026-04-08T17:33:33.852Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2024-01-18T15:27:34.001Z"},"containers":{"cna":{"title":"Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure","descriptions":[{"lang":"en","value":"The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API."}],"affected":[{"vendor":"intoxstudio","product":"Restrict User Access – Ultimate Membership & Content Protection","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.5","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67684cd-3e0f-48bb-967a-16ea2b027843?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037773%40restrict-user-access%2Ftrunk&old=3010745%40restrict-user-access%2Ftrunk&sfp_email=&sfph_mail="}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"CWE-284 Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-04-08T17:33:33.852Z"},"credits":[{"lang":"en","type":"finder","value":"Francesco Carlucci"}],"timeline":[{"time":"2024-02-26T00:00:00.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-0687","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-03-13T17:52:40.132502Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:22:17.419Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67684cd-3e0f-48bb-967a-16ea2b027843?source=cve","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037773%40restrict-user-access%2Ftrunk&old=3010745%40restrict-user-access%2Ftrunk&sfp_email=&sfph_mail=","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:11:35.774Z"}}]}}}