CVE-2024-12434 is a vulnerability in the Brainstorm Force SureMembers WordPress plugin (versions up to 1.10.6) where the REST API improperly exposes sensitive information, including restricted content, to unauthenticated users. This issue is categorized under CWE-200 (Exposure of Sensitive Information). The vulnerability allows attackers without any privileges to retrieve data that should be protected, potentially leading to unauthorized data disclosure. The CVSS v3.1 base score is 5.3, with attack vector network, low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to partial data disclosure. No official patch or remediation details are currently provided.

An unauthenticated attacker can access sensitive and restricted content through the plugin's REST API, leading to unauthorized disclosure of information. There is no indication of integrity or availability impact. The exposure could compromise confidentiality of data managed by the SureMembers plugin on affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the REST API endpoints used by SureMembers or disabling the plugin if sensitive data exposure risk is unacceptable. Monitor vendor communications for updates on patches or official mitigations.