PT-2022-9669 · WordPress · Paid Memberships Pro

Krzysztof Zając · Published 2022-02-07 · Updated 2026-04-18 · CVE-2021-25114

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro WordPress plugin versions prior to 2.6.7

Description The issue concerns a SQL injection problem. It occurs because the discount code is not properly escaped before being used in a SQL statement, specifically in one of the plugin's REST routes that is accessible to unauthenticated users.

Recommendations For versions prior to 2.6.7, update to version 2.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST route until the update can be applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-25114

Affected Products

Paid Memberships Pro

References · 6

• 🔥 https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b · Exploit
• https://osv.dev/vulnerability/CVE-2021-25114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25114 · Security Note
• https://paidmembershipspro.com/pmpro-update-2-6-7-security-release · Vendor Advisory
• https://t.me/cibsecurity/36939 · Telegram Post
• https://twitter.com/ctiwatchcloud/status/2045326482025718264 · Twitter Post