CVE

CVE-2021-25114

9.8

CVSS

Description

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection

Attack Vector

Privileges Req.

User Interaction

paid memberships pro

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-25114 Scanner

CVE-2021-25114 scanner - SQL Injection vulnerability in Paid Memberships Pro plugin for Wordpress

Used 2.2k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: paid memberships pro

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →