{"id":"CVE-2021-24728","state":"PUBLISHED","title":"Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection","description":"The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.","publishedAt":"2021-09-13T17:56:44.000Z","updatedAt":"2024-08-03T19:42:16.634Z","severity":null,"assigner":"WPScan","products":["Unknown Membership & Content Restriction – Paid Member Subscriptions"],"affected":[{"vendor":"Unknown","product":"Membership & Content Restriction – Paid Member Subscriptions","versions":[{"version":"2.4.2","status":"affected","lessThan":"2.4.2","versionType":"custom"}]}],"references":["https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172","https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38","https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24728.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24728","state":"PUBLISHED","datePublished":"2021-09-13T17:56:44.000Z","dateUpdated":"2024-08-03T19:42:16.634Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection","descriptions":[{"lang":"en","value":"The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages."}],"affected":[{"vendor":"Unknown","product":"Membership & Content Restriction – Paid Member Subscriptions","versions":[{"version":"2.4.2","status":"affected","lessThan":"2.4.2","versionType":"custom"}]}],"references":[{"url":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172","tags":["x_refsource_MISC"]},{"url":"https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38","tags":["x_refsource_MISC"]},{"url":"https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2021-09-13T17:56:44.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Martin Vierula of Trustwave"}],"source":{"discovery":"UNKNOWN"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24728","STATE":"PUBLIC","TITLE":"Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Membership & Content Restriction – Paid Member Subscriptions","version":{"version_data":[{"version_affected":"<","version_name":"2.4.2","version_value":"2.4.2"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Martin Vierula of Trustwave"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages."}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89 SQL Injection"}]}]},"references":{"reference_data":[{"name":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172","refsource":"MISC","url":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172"},{"name":"https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38","refsource":"MISC","url":"https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38"},{"name":"https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions","refsource":"CONFIRM","url":"https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29172","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://wpscan.com/vulnerability/2277d335-1c90-4fa8-b0bf-25873c039c38","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2566399/paid-member-subscriptions","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:42:16.634Z"}}]}}}