CVE-2023-0631

Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection

The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.

Affected

Paid Memberships Pro

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

60.45% chance of exploitation in the next 30 days, 99th percentile

Published

2023-03-20

Updated

2025-02-26

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79

References

• CVE Record
• NVD entry