published February 7, 2022
NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.
⚠️ A sneaky oversight means unauthenticated users can exploit the Paid Memberships Pro plugin — it doesn’t escape discount codes entered in a REST route! 🚨 Think of it like a restaurant that allows walk-ins where anyone can scribble their own dish on the order pad without a check, potentially ruining the whole menu. An attacker could exploit this SQL injection vulnerability to manipulate the database. They could access sensitive information, modify user data, or even delete records, wreaking havoc on the site’s integrity.
Think of it like a restaurant that allows walk-ins where anyone can scribble their own dish on the order pad without a check, potentially ruining the whole menu. This vulnerability arises from a lack of input sanitization on the discount_code parameter in the plugin’s REST API, allowing an attacker to inject malicious SQL queries.
An attacker could exploit this SQL injection vulnerability to manipulate the database. They could access sensitive information, modify user data, or even delete records, wreaking havoc on the site’s integrity. Update the Paid Memberships Pro plugin to version 2.6.7 or later to mitigate this vulnerability. Always validate and sanitize input in your applications to prevent SQL injection. You've got this! Keep your site secure with timely updates and vigilance. 🛡️