Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
Priority MEDIUM 41CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
Why it matters now
EPSS 0.01713 77th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Membership & Content Restriction – Paid Member Subscriptions (Unknown): 2.4.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Membership & Content Restriction – Paid Member Subscriptions | 2.4.2 to before 2.4.2 | 2.4.2 | Patch available | CNA |
- Membership & Content Restriction – Paid Member Subscriptions VendorUnknown Affected 2.4.2 to before 2.4.2 Fixed in 2.4.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cozmoslabs:membership_\&_content_restriction_-_paid_member_subscriptions:*:*:*:*:*:wordpress:*:* | before 2.4.2 | Vulnerable | Cozmoslabs |
- cpe:2.3:a:cozmoslabs:membership_\&_content_restriction_-_paid_member_subscriptions:*:*:*:*:*:wordpress:*:* Versions before 2.4.2 Vulnerable ·Cozmoslabs
Remediation
- Fix · CNA Membership & Content Restriction – Paid Member Subscriptions (Unknown) Fixed in 2.4.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24728
- 2026-10-03 Alias added: GHSA-wq6m-fwgx-fx9f
References
More Cozmoslabs Membership & Content Restriction - Paid Member Subscriptions vulnerabilities
- TI-2024-11970 Improper authentication in Cozmoslabs Paid Membership Subscriptions – Effortless… CVSS 3.1CRITICAL 9.8
- TI-2024-09507 Code injection in Cozmoslabs Paid Membership Subscriptions – Effortless Memberships… CVSS 3.1HIGH 7.3
- TI-2024-10460 Information disclosure in Cozmoslabs Paid Membership Subscriptions – Effortless… CVSS 3.1MEDIUM 5.3
- TI-2024-01296 Missing authorization in Cozmoslabs Paid Membership Subscriptions – Effortless… CVSS 3.1MEDIUM 5.3
- TI-2024-08558 Cross-site scripting in Cozmoslabs Paid Membership Subscriptions – Effortless… CVSS 3.1MEDIUM 6.1
- TI-2024-01297 Missing authorization in Cozmoslabs Paid Membership Subscriptions – Effortless… CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-24728 · CVE Program
- CVE-2021-24728 · NVD
- FIRST EPSS
- GHSA-wq6m-fwgx-fx9f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences