CVE-2021-20678
📋 TL;DR
This SQL injection vulnerability in Paid Memberships Pro WordPress plugin allows authenticated attackers to execute arbitrary SQL commands on the database. It affects all WordPress sites running Paid Memberships Pro versions before 2.5.6. Attackers could potentially read, modify, or delete database content.
💻 Affected Systems
- Paid Memberships Pro WordPress Plugin
📦 What is this software?
Paid Memberships Pro by Strangerstudios
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, site takeover, or complete data destruction.
Likely Case
Data exfiltration of sensitive user information, membership data, or payment details stored in the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authenticated access but SQL injection vulnerabilities are typically easy to exploit once vectors are identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.6
Vendor Advisory: https://www.paidmembershipspro.com/pmpro-update-2-5-6/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Paid Memberships Pro
4. Click 'Update Now' if available
5. If manual update needed, download version 2.5.6+ from WordPress.org
6. Deactivate old plugin, upload new version, activate
🔧 Temporary Workarounds
Input Validation Filter
allAdd custom input validation for Paid Memberships Pro parameters
Add custom WordPress filter hooks to sanitize user inputs before processing
Temporary Plugin Deactivation
linuxDisable Paid Memberships Pro until patched
wp plugin deactivate paid-memberships-pro
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → Paid Memberships Pro versionCheck Version:
wp plugin get paid-memberships-pro --field=versionVerify Fix Applied:
Verify plugin version is 2.5.6 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL-like patterns in requests
Network Indicators:
- HTTP POST requests with SQL syntax in parameters to Paid Memberships Pro endpoints
SIEM Query:
SELECT * FROM web_logs WHERE url LIKE '%/wp-content/plugins/paid-memberships-pro/%' AND (request LIKE '%UNION%' OR request LIKE '%SELECT%' OR request LIKE '%INSERT%' OR request LIKE '%DELETE%')🔗 References
- https://jvn.jp/en/jp/JVN08191557/index.html
- https://wordpress.org/plugins/paid-memberships-pro/
- https://www.paidmembershipspro.com/pmpro-update-2-5-6/
- https://jvn.jp/en/jp/JVN08191557/index.html
- https://wordpress.org/plugins/paid-memberships-pro/
- https://www.paidmembershipspro.com/pmpro-update-2-5-6/
