Non notée
CVE-2021-25114 The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route…
Description
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Paid Memberships Pro 2.6 | premières → < 2.6.7 | 2.6.7 |
Références
- wpscan.com wpscan.com
- www.paidmembershipspro.com www.paidmembershipspro.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Paid Memberships Pro
Les 5 CVE de Paid Memberships Pro →
CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from…
4.3
Moyenne
CVE-2023-0631
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that…
Non notée
CVE-2022-4830
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…
6.1
Moyenne
CVE-2021-24979
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an…
Non notée