CVE-2021-24728: Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24728?
CVE-2021-24728 is a vulnerability in the Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before version 2.4.2.
What is the severity of CVE-2021-24728?
CVE-2021-24728 has a severity value of 8.8, which is considered high.
How does CVE-2021-24728 impact the Membership & Content Restriction – Paid Member Subscriptions plugin?
CVE-2021-24728 allows for Authenticated SQL Injections on the Members and Payments pages of the plugin.
How can I fix CVE-2021-24728?
To fix CVE-2021-24728, you should update the Membership & Content Restriction – Paid Member Subscriptions plugin to version 2.4.2 or later.
Where can I find more information about CVE-2021-24728?
You can find more information about CVE-2021-24728 at the following references: [Reference 1](https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions), [Reference 2](https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38), [Reference 3](https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172)