CVE-2021-20678

8.8 highEPSS 2.0%

High (8.8) in strangerstudios paid memberships pro. EPSS 2.0% chance of exploitation in the next 30 days.

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-11-01)
CWE: CWE-89
Published: 2021-03-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

strangerstudios:paid_memberships_pro

References

https://jvn.jp/en/jp/JVN08191557/index.html
https://wordpress.org/plugins/paid-memberships-pro/
https://www.paidmembershipspro.com/pmpro-update-2-5-6/
https://jvn.jp/en/jp/JVN08191557/index.html
https://wordpress.org/plugins/paid-memberships-pro/

Check your stack JSON