What’s Vulnerable › Vulnerabilities

CVE-2021-24728: Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-13 · updated 2026-06-17
• Weakness: CWE-89

Description

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.

Affected products

• cozmoslabs Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: before 2.4.2 — fixed in 2.4.2

How to fix

Upgrade to a fixed version: cozmoslabs Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction 2.4.2. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions
• https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172
• https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions
• https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172

Get alerted when CVE-2021-24728 or the next vulnerability affects your stack