CVE-2024-2920 is an information exposure vulnerability in the WP-Members Membership Plugin for WordPress (versions up to 3.4.9.3). The plugin uploads user-supplied files to a publicly accessible directory (wp-content) without enforcing access controls, allowing unauthenticated attackers to view files uploaded by other users. This exposure can lead to unauthorized disclosure of potentially sensitive data. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 5.3, indicating medium severity. No patch or official fix has been documented yet.

An attacker without any authentication can access files uploaded by other users due to the lack of access restrictions on the upload directory. This can lead to unauthorized disclosure of sensitive information contained within those files. The vulnerability does not affect integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting direct access to the wp-content upload directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized file access. Review and limit the types of files users can upload and consider implementing additional access controls at the application or server level.