CVE-2023-0631

8.8 highEPSS 60%

High (8.8) in strangerstudios paid memberships pro. EPSS 60% chance of exploitation in the next 30 days.

The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 60% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

strangerstudios:paid_memberships_pro

References

https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79
https://wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79

Check your stack JSON