High severity8.8NVD Advisory· Published Mar 20, 2023· Updated Jun 17, 2026

CVE-2023-0631

Description

The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Strangerstudios/Paid Memberships Pro
cpe:2.3:a:strangerstudios:paid_memberships_pro:*:*:*:*:*:wordpress:*:*
Range: <2.9.12
WordPress/Paid Membershipcpe-rescue
Package: https://wordpress.org/plugins/paid-membership
WordPress/Paid Memberships Prollm-fuzzy
Range: <2.9.12

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/19ef92fd-b493-4488-91f0-e6ba51362f79nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.048
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000