The Paid Member Subscriptions plugin for WordPress contains a critical SQL injection vulnerability that could allow an unauthenticated attacker to extract sensitive database information.

This vulnerability is caused by improper neutralization of special elements used in SQL commands (CWE-89). It allows an unauthenticated attacker to manipulate database queries via the affected plugin.

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially bypass authentication, exfiltrate sensitive user data, or modify database records, leading to severe reputational damage and regulatory compliance failures. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data access.

Immediate Action: Since a specific patch version is not currently identified, users should monitor the Cozmoslabs official security advisories or the Patchstack database for the release of a secure version and update the plugin immediately upon availability.

Proactive Monitoring: Security teams should review database logs for anomalous query patterns or unusual syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to block common SQL injection patterns to provide a virtual patch until the software vendor issues a permanent fix.

Public Exploit Available: Unknown.

Given the potential for unauthorized database access, administrators should prioritize the remediation of this vulnerability. If an update is not yet available, consider temporarily deactivating the Paid Member Subscriptions plugin or restricting access to the associated application interfaces until a secure version is deployed to mitigate the risk of exploitation.