Description
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Paid Memberships Pro | 1.5.5 – < 2.9.12 | 2.9.12 |
References
- https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79 exploit vdb-entry technical-description