Paid Memberships Pro vulnerabilities

2 known vulnerabilities in Paid Memberships Pro from Strangerstudios. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Paid Memberships Pro – Content Restriction…: Unrestricted Upload of File with Dangerous Type

  CVE-2023-6187Nov 18, 2023StrangerstudiosEPSS 51.3%

  The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible f

• 9.8 Critical severity

  Paid Memberships Pro WordPress Plugin: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-23488Jan 20, 2023Paid Memberships Pro WordPress PluginEPSS 92.5%

  The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.