Vulnerability · Published Mar 20, 2023 · Assigned by WPScan
CVE-2023-0631Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
High 8.8
In plain English
A high-severity SQL injection in Paid Memberships Pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 60.5% (higher than 99.1% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)60.5%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Paid Memberships Pro | 1.5.5 – before 2.9.12 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79 exploit, vdb-entry, technical-description