CVE-2021-24728 Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

2021-09-1317:56:44

CWE-89

WPScan

www.cve.org

cve-2021-24728

sql injection

wordpress plugin

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

55.5%

JSON

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.

CNA Affected

[
  {
    "product": "Membership & Content Restriction – Paid Member Subscriptions",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.4.2",
        "status": "affected",
        "version": "2.4.2",
        "versionType": "custom"
      }
    ]
  }
]