Version 2.12.6 of Paid Memberships Pro is out with a very important security fix.

All versions of PMPro since 2.3 are vulnerable to the issue fixed in this release. The vulnerability allows malicious actors with no authorization to add new levels or change the details of existing levels, including the level price. With this ability, someone could change a level price to $0, allowing them to bypass your paywall or otherwise cause issues with your site.

You can update Paid Memberships Pro from the plugins page of your WordPress dashboard or get the latest version of PMPro here.

We have no reason to believe that this vulnerability is being abused widely, but to be sure your site was not impacted by this issue, double-check that your levels are all still configured as intended.

Thanks to Craig Smith and WordFence for the responsible disclosure of this issue.

Development Changelog for Paid Memberships Pro Release Updates

The full list of updates in v2.12.6 is below.

  • SECURITY: Fixed a security issue where unauthorized users could abuse the REST API endpoints to add new levels or edit existing levels. (Thanks, Craig Smith at WordFence)
  • BUG FIX: Now hiding level confirmation messages from the output returned by the checkout_levels API route.
Jason Coleman

Author: Jason Coleman

Jason Coleman is the co-founder and CEO of Paid Memberships Pro, the most trusted membership platform that grows with you. With a deep passion for open source software, Jason is the author of Building Web Apps With WordPress, published by O'Reilly Media.

Jason's entrepreneurial spirit is driven by uncertainty, risk, and the thrill of new opportunities. With over two decades of experience in development, management, and marketing, he is committed to Paid Memberships Pro: the only open source platform focused on helping creators get paid so they can find freedom in their life and fulfill their goals.

View more articles by Jason Coleman »

Was this article helpful?
YesNo