CVE-2023-23488

2023-01-2018:15:10

CWE-89

[email protected]

web.nvd.nist.gov

139

paid memberships pro

wordpress

plugin

sql injection

vulnerability

nvd

cve-2023-23488

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.054 Low

EPSS

Percentile

93.2%

JSON

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the ‘code’ parameter of the ‘/pmpro/v1/order’ REST route.

Affected configurations

NVD

Node

strangerstudiospaid_memberships_proRange<2.9.8wordpress

CPENameOperatorVersion
strangerstudios:paid_memberships_prostrangerstudios paid memberships prolt2.9.8

CPE	Name	Operator	Version
strangerstudios:paid_memberships_pro	strangerstudios paid memberships pro	lt	2.9.8

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Paid Memberships Pro WordPress Plugin",
    "versions": [
      {
        "version": "< 2.9.8",
        "status": "affected"
      }
    ]
  }
]