critical9.8Public exploit code
CVE-2023-23488
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection2023-04-03 · webapps · php · Verified
Impact
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strangerstudios | Paid Memberships Pro | before 2.9.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171661/WordPress-Paid-Memberships-Pro-2.9.8-SQL-Injection.html
- https://www.tenable.com/security/research/tra-2023-2
- http://packetstormsecurity.com/files/171661/WordPress-Paid-Memberships-Pro-2.9.8-SQL-Injection.html
- https://www.tenable.com/security/research/tra-2023-2