CVE-2021-20678

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Stranger Studios	Paid Memberships Pro	versions prior to 2.5.6

References

https://jvn.jp/en/jp/JVN08191557/index.htmlThird Party Advisory
https://wordpress.org/plugins/paid-memberships-pro/Product, Third Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-5-6/Vendor Advisory
https://jvn.jp/en/jp/JVN08191557/index.htmlThird Party Advisory
https://wordpress.org/plugins/paid-memberships-pro/Product, Third Party Advisory
https://www.paidmembershipspro.com/pmpro-update-2-5-6/Vendor Advisory

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-206797.5Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, A CVE-2021-20688.6Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions th CVE-2021-206806.1Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 a CVE-2021-206815.4Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated att CVE-2021-206827.2baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified CVE-2021-206835.4Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authentic CVE-2021-206846.1Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-206856.1Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-206866.1Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-206878.8Cross-site request forgery (CSRF) vulnerability in Kagemai 0.8.8 allows remote attackers to hijack the authentication of administrators via CVE-2021-206886.1Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.CVE-2021-206896.1Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.