Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
CVE-2021-24728
8.8HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 13 September 2021
What is CVE-2021-24728?
The Membership & Content Restriction β Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Membership & Content Restriction β Paid Member Subscriptions 2.4.2
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Martin Vierula of Trustwave