CVE-2023-23488

2023-01-2000:00:00

tenable

www.cve.org

paid memberships pro

wordpress plugin

sql injection

rest route

unauthenticated

0.054 Low

EPSS

Percentile

93.2%

JSON

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the ‘code’ parameter of the ‘/pmpro/v1/order’ REST route.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Paid Memberships Pro WordPress Plugin",
    "versions": [
      {
        "version": "< 2.9.8",
        "status": "affected"
      }
    ]
  }
]