CVE-2021-25114: Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-07 · updated 2026-06-17
Weakness: CWE-89

Description

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection

Affected products

Paid Memberships Pro: from 2.4 before 2.4.5; from 2.5 before 2.5.11; from 2.6 before 2.6.7 — fixed in 2.4.5, 2.5.11, 2.6.7

How to fix

Upgrade to a fixed version: Paid Memberships Pro 2.4.5, 2.5.11, 2.6.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b
https://www.paidmembershipspro.com/pmpro-update-2-6-7-security-release/
https://wpscan.com/vulnerability/6c25a5f0-a137-4ea5-9422-8ae393d7b76b
https://www.paidmembershipspro.com/pmpro-update-2-6-7-security-release/

Get alerted when CVE-2021-25114 or the next vulnerability affects your stack