Version 2.12.6 of Paid Memberships Pro is out with a very important security fix.

All versions of PMPro since 2.3 are vulnerable to the issue fixed in this release. The vulnerability allows malicious actors with no authorization to add new levels or change the details of existing levels, including the level price. With this ability, someone could change a level price to $0, allowing them to bypass your paywall or otherwise cause issues with your site.

Please update Paid Memberships Pro from the plugins page of your WordPress dashboard. You can also get the latest version of PMPro here. We recommend that everyone upgrade as soon as possible.

We have no reason to believe that this vulnerability is being abused widely, but to be sure your site was not impacted by this issue, double-check that your levels are all still configured as intended.

Thanks to Craig Smith and WordFence for the responsible disclosure of this issue.

Development Changelog for Paid Memberships Pro Release Updates

The full list of updates in v2.12.6 is below.

  • SECURITY: Fixed a security issue where unauthorized users could abuse the REST API endpoints to add new levels or edit existing levels. (Thanks, Craig Smith at WordFence)
  • BUG FIX: Now hiding level confirmation messages from the output returned by the checkout_levels API route.
Jason Coleman

Author: Jason Coleman

Jason is co-founder of Paid Memberships Pro, the 100% open source membership plugin for WordPress. He has been pushing WordPress to its limits for many years and is an advocate for using WordPress as an application framework to build web sites and apps that go above and beyond the typical blog or CMS site.

Was this article helpful?
YesNo