Simple Membership, 17527cfb2d42b5bacb8d579c3d6814f8a6188bfb

CVE, Research URL: 17527cfb2d42b5bacb8d579c3d6814f8a6188bfb
Home page URL: Security reports for Simple Membership
Application: Simple Membership
Published on: Apr 05, 2021
Research Description: Simple Membership [simple-membership] < 4.0.4 Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections The Simple Membership plugin for WordPress is vulnerable to time-based SQL Injection via the 's' and 'status' parameters in versions up to, and including, 4.0.3 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated Admin+ attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 4.0.4.
Status: vulnerable