Critical · published January 20, 2023
CVSS calls it critical at 9.8. It sits in the 99.8th percentile for exploit probability.
🚨 An unauthenticated SQL injection vulnerability in Paid Memberships Pro could unleash a whirlwind of chaos for your WordPress site! 🔥 Think of this vulnerability as a sneaky email that gets past your spam filter and allows the sender to access your private files without you ever knowing — it slips in unnoticed! If exploited, an attacker could manipulate your database and gain access to sensitive data, modify orders, or even delete vital information. This could lead to a complete compromise of your site's integrity and trustworthiness — absolutely devastating!
Think of this vulnerability as a sneaky email that gets past your spam filter and allows the sender to access your private files without you ever knowing — it slips in unnoticed! This vulnerability allows attackers to inject malicious SQL commands through the 'code' parameter in the '/pmpro/v1/order' REST route, without needing any authentication to access it.
If exploited, an attacker could manipulate your database and gain access to sensitive data, modify orders, or even delete vital information. This could lead to a complete compromise of your site's integrity and trustworthiness — absolutely devastating! Update Paid Memberships Pro to version 2.9.8 or later immediately to patch this vulnerability. Conduct regular audits of your REST API endpoints to ensure no other vulnerabilities lurk in the shadows. You've got this! With a quick update, your site will be fortified and ready to take on the world! 🛡️