CVE-2021-25114
CRITICAL EXPLOITED NUCLEIPaid Memberships Pro <2.6.7 - SQL Injection
Title source: llmDescription
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Nuclei Templates (1)
WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection
CRITICALVERIFIEDby theamanrawat
Shodan:
http.html:/wp-content/plugins/paid-memberships-pro/
FOFA:
body=/wp-content/plugins/paid-memberships-pro/
Scores
CVSS v3
9.8
EPSS
0.7852
EPSS Percentile
99.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2024-04-11
CWE
CWE-89
Status
published
Products (1)
strangerstudios/paid_memberships_pro
2.4 - 2.4.5
Published
Feb 07, 2022
Tracked Since
Feb 18, 2026