CVE-2021-24728: 
WordPress vulnerability analysis and mitigation

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before version 2.4.2 contained a SQL injection vulnerability. The vulnerability existed because the plugin failed to properly sanitize, validate, or escape its order and orderby parameters before using them in SQL statements, affecting the Members and Payments pages (WPScan, NVD).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (HIGH). The attack requires network access and low privileges but no user interaction. The vulnerability allows authenticated users to inject malicious SQL commands through the unvalidated order and orderby parameters in the Members and Payments pages (WPScan, NVD).

If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized access to sensitive data, modification of database contents, or compromise of the database server (NVD).

Users should upgrade to version 2.4.2 or later of the Membership & Content Restriction – Paid Member Subscriptions WordPress plugin, which contains fixes for this vulnerability (WordPress Plugin).

The vulnerability was discovered and reported by Martin Vierula of Trustwave (WPScan).