CVE-2023-0631: falha em Paid Memberships Pro
Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
15Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 60%
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Produtos afetados
Unknown · Paid Memberships ProCVEs relacionadas — Paid Memberships Pro
No mesmo produto, das mais perigosas para as menos.
CVE-2021-25114—Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL InjectionEPSS 81.8%CVE-2022-4830MEDIUMPaid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via ShortcodeEPSS 65.0%CVE-2021-24979—Paid Memberships Pro < 2.6.6 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2024-1279MEDIUMPaid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field DisclosureEPSS 0.5%