Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
15Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 60%
exploitation probability
60%top 1% of all CVEs
observed exploitation
nono source reports it
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Affected products
Unknown · Paid Memberships Pro