CVE-2021-25114

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection...

CVE-2021-25114

creationtimestamp| type| source ---|---|--- 2022-02-07 18:34:50+00:00| seen| https://t.me/cibsecurity/36939 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25114.yaml 2025-01-26 00:00:00+00:00| seen| The Shadowserver...

CVE-2021-25114

CVE-2021-25114 affects WordPress plugin Paid Memberships Pro prior to 2.6.7. The root cause is failure to escape the discount_code in a REST route (accessible to unauthenticated users) before it is interpolated into a SQL statement, enabling a blind SQL injection. Exploitation could allow an atta...

CVE-2021-25114 Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection...