The Members – Membership & User Role Editor Plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) identified as CVE-2024-11008. This flaw exists in all versions up to and including 3.2.10 and leverages the WordPress core search feature to allow unauthenticated attackers to extract data from posts restricted to privileged roles such as administrators. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with an attack vector of network, low complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability.

An unauthenticated attacker can extract sensitive information from posts restricted to higher-level user roles, potentially exposing confidential data intended only for administrators or other privileged users. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported at this time.

No official patch or remediation has been published by the vendor as of now. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting the WordPress core search feature for unauthenticated users or limiting access to sensitive posts through additional access controls to reduce exposure.