CVE-2014-8801: Strangerstudios Paid Memberships Pro

Medium severity, CVSS 5.0. EPSS: 18% chance of exploitation in the next 30 days.

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.

Affected products

• Strangerstudios Paid Memberships Pro: before 1.7.15 (fixed in 1.7.15)

Published 2014-11-28. Last modified 2026-06-17.