CVE-2023-6187

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.

• CWE-434
• CWE-434

• https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.3/includes/fields.php#L564Product
• https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.phpPatch
• https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.phpPatch
• https://www.paidmembershipspro.com/pmpro-update-2-12-4/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.3/includes/fields.php#L564Product
• https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/fields.phpPatch
• https://plugins.trac.wordpress.org/changeset/2997319/paid-memberships-pro/tags/2.12.4/includes/functions.phpPatch
• https://www.paidmembershipspro.com/pmpro-update-2-12-4/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=cvePatch, Third Party Advisory

Published

Nov 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6179Honeywell ProWatch, 4.5, including all Service Pack versions…7.8
• CVE-2023-6180The tokio-boring library in version 4.0.0 is affected by a m…5.3
• CVE-2023-6181An oversight in BCB handling of reboot reason that allows fo…9.8
• CVE-2023-6184Cross SiteScripting vulnerability in Citrix Session Recordin…7.2
• CVE-2023-6185Improper Input Validation vulnerability in GStreamer integra…8.8
• CVE-2023-6186Insufficient macro permission validation of The Document Fou…8.8
• CVE-2023-6188A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It …9.8
• CVE-2023-6189Missing access permissions checks in the M-Files server be…5.3
• CVE-2023-6190Improper Limitation of a Pathname to a Restricted Directory …9.8
• CVE-2023-6191Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-6193quiche v. 0.15.0 through 0.19.0 was discovered to be vulnera…5.3
• CVE-2023-6194In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report de…7.1