VULNERABILITY INTELLIGENCE
CVE-2021-24728
CVSS score8.8 HIGH
EPSS probability1.71%
CISA KEVNot currently listed
Published2021-09-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
Weakness classification
- contact@wpscan.com: CWE-89
- nvd@nist.gov: CWE-89
Primary references
- contact@wpscan.com — Third Party Advisory
- contact@wpscan.com — Exploit, Third Party Advisory
- contact@wpscan.com — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory