{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-03T03:54:26.022","vulnerabilities":[{"cve":{"id":"CVE-2024-9262","sourceIdentifier":"security@wordfence.com","published":"2024-11-09T03:15:05.970","lastModified":"2026-06-17T08:24:14.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain user meta values from form fields. Please note that this requires a site administrator to create a form that displays potentially sensitive information like password hashes. This may also be exploited by unauthenticated users if the  'user-meta-public-profile' shortcode is used insecurely."},{"lang":"es","value":"El complemento User Meta – User Profile Builder y User management para WordPress es vulnerable a la referencia directa a objetos inseguros en todas las versiones hasta la 3.1 incluida a través de getUser() debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, obtengan valores meta de usuario de los campos de formulario. Tenga en cuenta que esto requiere que un administrador del sitio cree un formulario que muestre información potencialmente confidencial, como hashes de contraseñas. Esto también puede ser explotado por usuarios no autenticados si el código corto 'user-meta-public-profile' se usa de forma insegura."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"khaledsaikat","product":"User Meta – User Profile Builder and User management plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-12T15:44:50.351301Z","id":"CVE-2024-9262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/user-meta/trunk/models/classes/generate/PublicProfile.php#L28","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3221099%40user-meta&new=3221099%40user-meta&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed81348-7604-4858-bc8e-b4504d77ee45?source=cve","source":"security@wordfence.com"}]}}]}