{"id":"CVE-2021-24728","aliases":["EUVD-2021-11640","GHSA-wq6m-fwgx-fx9f"],"status":"published","title":"Paid Member Subscriptions \u003c 2.4.2 - Authenticated SQL Injection","description":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01713,"percentile":0.77725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-89"],"published":"2021-09-13T17:56:44Z","modified":"2026-06-17T03:40:48Z","products":[{"vendor":"cozmoslabs","product":"membership_\\\u0026_content_restriction_-_paid_member_subscriptions"},{"vendor":"unknown","product":"membership \u0026 content restriction – paid member subscriptions"}],"references":[{"url":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24728"},{"url":"https://github.com/advisories/GHSA-wq6m-fwgx-fx9f"}],"sources":{"cve":[{"id":"CVE-2021-24728","title":"Paid Member Subscriptions \u003c 2.4.2 - Authenticated SQL Injection","description":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","status":"published","published":"2021-09-13T17:56:44Z","modified":"2024-08-03T19:42:16.634Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11640","description":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","status":"published","published":"2021-09-13T17:56:44Z","modified":"2024-08-03T19:42:16Z","updated_at":"2026-11-03T03:24:56.31224Z"}],"ghsa":[{"id":"GHSA-wq6m-fwgx-fx9f","title":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2...","description":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","status":"published","published":"2022-05-24T22:29:04Z","modified":"2023-01-27T05:04:16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79","CWE-89"],"updated_at":"2026-11-02T14:42:25.677567Z"}],"nvd":[{"id":"CVE-2021-24728","description":"The Membership \u0026 Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","status":"published","published":"2021-09-13T18:15:19.283Z","modified":"2026-06-17T03:40:48.407Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:58.502206Z"}]}}