← Vulnerability feed

Vulnerability record · CVE-2021-20678 · published 18 March 2021

CVE-2021-20678: Strangerstudios paid memberships pro sql injection vulnerability

Strangerstudios · Paid Memberships Pro

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

8.8 CVSS 3.1 High EPSS 2.0% · top 19.6% CWE-89 · SQL injection
8.8CVSS 3.1 base score, v2 6.5
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/en/jp/JVN08191557/index.html Third Party Advisory
https://wordpress.org/plugins/paid-memberships-pro/ ProductThird Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-5-6/ Vendor Advisory
https://jvn.jp/en/jp/JVN08191557/index.html Third Party Advisory
https://wordpress.org/plugins/paid-memberships-pro/ ProductThird Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-5-6/ Vendor Advisory

Track CVE-2021-20678 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-37277Strangerstudios paid memberships pro insecure direct object reference vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACL…EPSS 0.67%9.8CVE-2023-23488Paid Memberships Pro WordPress plugin unauthenticated SQL injectionThe Paid Memberships Pro WordPress plugin before version 2.9.8 is affected by an unauthenticated SQL injection in the 'code' parameter of the '/pmpro…EPSS 92%analysed9.8CVE-2021-25114Paid Memberships Pro unauthenticated SQL injection via discount_codeThe Paid Memberships Pro WordPress plugin before 2.6.7 fails to escape the discount_code parameter in a REST route that is reachable without authenti…EPSS 82%analysed8.8CVE-2023-39990Strangerstudios paid memberships pro missing authorization vulnerabilityMissing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.EPSS 0.48%8.8CVE-2024-32793Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.23%8.8CVE-2024-32794Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.25%8.8CVE-2023-6187Paid Memberships Pro WordPress plugin arbitrary file uploadThe Paid Memberships Pro plugin for WordPress fails to properly validate file types in the pmpro_paypalexpress_session_vars_for_user_fields function …EPSS 51%analysed8.8CVE-2023-0631Paid Memberships Pro WordPress plugin SQL injection via shortcodesThe Paid Memberships Pro WordPress plugin before 2.9.12 fails to prevent subscribers from rendering shortcodes that concatenate attributes directly i…EPSS 60%analysed

Source: NIST National Vulnerability Database (record CVE-2021-20678), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.