CVE-2024-37486
WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability
CVE-2024-37486 is a high vulnerability (CVSS 7.6) in Paid Memberships Pro Memberships Pro, published July 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 55th percentile. No source names a fixed version.
- Severity
- 7.6 HighCVSS 3.1, CVE List
- Exploit chance
- 0.74%EPSS, 55th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Exploit likelihood
Affected products
What each source reports
CVE List Score used
WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Record
CVE-2024-37486- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2024-36702
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Record
EUVD-2024-36702- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j3c9-j8gj-cwrv
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Record
GHSA-j3c9-j8gj-cwrv- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Record
CVE-2024-37486- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Record
CVE-2024-37486- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-5-authenticated-sql-injection-vulnerability?_s_id=cve
nvd.nist.gov/vuln/detail/CVE-2024-37486
github.com/advisories/GHSA-j3c9-j8gj-cwrv
wordpress.org/plugins