Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2020-37244WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx

High 8.2

In plain English

A high-severity SQL injection in Membership from Supsystic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 79.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.

Affected products (as reported)

Vendor	Product	Versions
Supsystic	Membership	1.4.7

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

ExploitDB-49540 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx third-party-advisory