CVE-2024-0624 is a CSRF vulnerability in the Paid Memberships Pro WordPress plugin (up to version 2.12.7) caused by improper nonce validation in the pmpro_update_level_order() function. This flaw enables unauthenticated attackers to update membership level orders by tricking site administrators into executing forged requests. The vulnerability does not require privileges or user interaction beyond the administrator being tricked. It is classified under CWE-352 and has a medium severity rating with a CVSS 3.1 score of 5.3.

Successful exploitation allows an attacker to modify the order of membership levels within the plugin without authentication, potentially disrupting site membership configurations. There is no direct confidentiality or availability impact reported. The attack requires social engineering to convince an administrator to perform an action, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the web application firewall or server level. Monitor for updates from strangerstudios regarding a security patch.