Not rated
CVE-2021-25114 The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route…
Description
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Paid Memberships Pro 2.6 | earliest → < 2.6.7 | 2.6.7 |
References
- wpscan.com wpscan.com
- www.paidmembershipspro.com www.paidmembershipspro.com
Timeline
- Published
- Last modified
Other CVEs of Paid Memberships Pro
The 5 CVEs of Paid Memberships Pro →
CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from…
4.3
Medium
CVE-2023-0631
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that…
Not rated
CVE-2022-4830
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…
6.1
Medium
CVE-2021-24979
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an…
Not rated