CVE-2021-24728
HIGHCozmoslabs Membership & Content Restriction - Paid Member Subscriptions < 2.4.2 - SQL Injection
Title source: ruleDescription
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38
Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions
Scores
CVSS v3
8.8
EPSS
0.0171
EPSS Percentile
74.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
cozmoslabs/membership_\&_content_restriction_-_paid_member_subscriptions
< 2.4.2
Published
Sep 13, 2021
Tracked Since
Feb 18, 2026