CVE-2021-25114: Strangerstudios Paid Memberships Pro

Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days.

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection

Affected products

• Strangerstudios Paid Memberships Pro: from 2.4, before 2.4.5 (fixed in 2.4.5); from 2.5, before 2.5.11 (fixed in 2.5.11); from 2.6, before 2.6.7 (fixed in 2.6.7)

Published 2022-02-07. Last modified 2026-06-17.