CVE-2023-0631: Paid Memberships Pro WordPress plugin SQL injection via shortcodes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact, a low-privilege authenticated vector, and public exploit material despite no KEV listing.

What it is

The Paid Memberships Pro WordPress plugin before 2.9.12 fails to prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query. This is a SQL injection (CWE-89) reachable by any authenticated subscriber, so a low-privileged account can tamper with the site's database.

Impact

An attacker with a subscriber account can inject SQL through shortcode attributes, gaining read and write access to the WordPress database, which can expose or alter membership and user data.

Attack surface

Reached over the network through crafted shortcode attributes rendered by the plugin; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a low-privilege authenticated subscriber is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.60452 (99.1st percentile) and the WPScan reference is tagged Exploit, indicating public exploit material exists.

What to do

• Update Paid Memberships Pro to version 2.9.12 or later.
• If immediate patching is not possible, restrict or disable shortcode rendering for subscriber-level roles.
• Audit and reduce subscriber accounts to only those genuinely needed.
• Review database and membership records for unexpected changes.
• Monitor plugin advisories for any follow-up fixes.

Detection

• Search web and database logs for shortcode attributes containing SQL metacharacters such as quotes, UNION or SELECT.
• Alert on subscriber-role requests that invoke plugin shortcodes with unusual attribute values.
• Review database queries or errors originating from the plugin around shortcode handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.