| Package | Affected versions | Patched versions |
|---|---|---|
| paid memberships pro | ≥ 2.4, < 2.4.5≥ 2.5, < 2.5.11≥ 2.6, < 2.6.7 | 2.4.52.5.112.6.7 |
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free