CVE-2021-25114: Paid Memberships Pro unauthenticated SQL injection via discount_code

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and very high EPSS makes this an urgent patch target.

What it is

The Paid Memberships Pro WordPress plugin before 2.6.7 fails to escape the discount_code parameter in a REST route that is reachable without authentication, then uses it directly in a SQL statement. This allows unauthenticated SQL injection against sites running the affected plugin.

Impact

An attacker can read and modify database contents, including user and membership data, and potentially execute administrative actions depending on database privileges.

Attack surface

Reached over the network through the plugin's unauthenticated REST route; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.818, 99.6th percentile) and a public exploit reference is tagged by WPScan, indicating active interest and likely weaponization.

What to do

• Update Paid Memberships Pro to 2.6.7 or later immediately.
• If patching is delayed, disable or restrict access to the plugin's REST routes, especially the discount_code endpoint.
• Apply a WAF rule to block SQL injection patterns on REST requests to the plugin.
• Audit database and membership records for signs of tampering after exposure.
• Review database account privileges to limit impact of successful injection.

Detection

• Monitor web logs for REST requests containing SQL metacharacters in discount_code or similar parameters.
• Alert on SQL error responses or unusual query patterns from the WordPress REST API.
• Hunt for unexpected changes to membership, user, or discount tables.
• Correlate requests to the plugin's REST endpoints from unauthenticated or anomalous sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.