CVE-2021-25114

Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

Basic Information

CVE State: PUBLISHED
Reserved Date: January 14, 2021
Published Date: February 07, 2022
Last Updated: August 03, 2024
Vendor: Unknown
Product: Paid Memberships Pro
Description: The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection

CVSS Scores

EPSS Score

Score: 73.55% (Percentile: 98.71%) as of 2025-04-29

Exploit Status

Exploited in the Wild: Yes (added 2025-04-28 00:00:00 UTC) Source

References

https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b https://www.paidmembershipspro.com/pmpro-update-2-6-7-security-release/

Known Exploited Vulnerability Information

Source	Added Date
The Shadowserver (via CIRCL)	2025-04-28 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25114.yaml	2025-04-26 00:00:00 UTC