The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HStrangerstudios Paid Memberships Pro
APPStrangerstudios< 2.9.8
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLi
Powiązane podatności
CVE-2021-25114CRITICAL9.8ten sam produkt
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST ro...
CVE-2024-37277HIGH7.5ten sam produkt
Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functi...
CVE-2024-37486HIGH7.6ten sam produkt
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Mem...
CVE-2023-6187HIGH7.5ten sam produkt
The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file...
CVE-2023-0631HIGH8.8ten sam produkt
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes...