CVE-2021-25114 describes a critical SQL injection vulnerability in the Paid Memberships Pro WordPress plugin versions prior to 2.6.7. An unauthenticated attacker can exploit a REST route that fails to properly escape the discount_code parameter, leading to arbitrary SQL execution. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a high potential for complete compromise of confidentiality, integrity, and availability with low attack complexity. While not listed in CISA KEV or Hot List, and with no known Metasploit or ExploitDB modules, Nuclei templates for blind SQL injection exist, and its high EPSS score suggests a significant likelihood of exploitation. Community discussion and media coverage are currently minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.4, < 2.4.5CPE matchmatch criteria | cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* | ||
>= 2.5, < 2.5.11CPE matchmatch criteria | cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* | ||
>= 2.6, < 2.6.7CPE matchmatch criteria | cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.