CVE-2024-8326 is a sensitive information exposure vulnerability (CWE-200) in the s2Member WordPress plugin affecting all versions up to and including 241114. Authenticated attackers with Contributor-level privileges can exploit the 'sc_get_details' function to extract sensitive user and database configuration information. This exposure can lead to unauthorized reading, updating, or dropping of database tables. Although version 241114 includes a partial fix, the vulnerability is present in earlier versions. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Exploitation allows an authenticated user with Contributor-level access or higher to access sensitive user data and database configuration information. This can lead to unauthorized database operations including reading, updating, or dropping tables, potentially compromising the integrity and confidentiality of the application data.

A partial patch was introduced in version 241114 of the s2Member plugin. Users should upgrade to version 241114 or later to mitigate this vulnerability. Since no full patch or vendor advisory is provided here, users should monitor the vendor's official channels for further updates or complete fixes. Until patched, restrict Contributor-level access carefully and consider additional access controls to limit exploitation.