CVE-2021-24728

EUVD-2021-11640
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
cozmoslabsmembership_\&_content_restriction_-_paid_member_subscriptions
𝑥
< 2.4.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions
https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172
https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions
https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172