WordPress plugin · paid-memberships-pro
Is Paid Memberships Pro safe?
Closed. Replace it.
wordpress.org closed it on Oct 17, 2024 (author request), so it gets no more security fixes, and 21 flaws are on record. If your site runs it, move to a maintained alternative.
- Flaws on record
- 21
- High or critical
- 7
- Exploited
- none
Every recorded flaw
- Jul 28, 2026Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Stored Cross-Site ScriptingCVE-2026-15016 · affects up to 3.8.1 · reported by WordfenceMedium 6.4
- May 2, 2026Paid Memberships Pro: Unauthorized modification and disruption of Stripe webhook configurationCVE-2026-4100 · affects up to 3.6.5 · reported by WordfenceHigh 7.1
- Nov 1, 2024Paid Memberships Pro: Authorization Bypass Through User-Controlled KeyCVE-2024-37277 · affects up to 3.0.4 · reported by PatchstackHigh 7.5
- Jul 9, 2024Paid Memberships Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37486 · affects up to 3.0.5 · reported by PatchstackHigh 7.6
- Jun 19, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-1407 · affects up to 2.12.10 · reported by WordfenceMedium 5.4
- May 2, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-3215 · affects up to 3.0.1 · reported by WordfenceMedium 5.3
- Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32794 · affects up to 2.12.10 · reported by PatchstackMedium 4.3
- Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32793 · affects up to 2.12.10 · reported by PatchstackMedium 5.4
- Apr 9, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-0588 · affects up to 2.12.10 · reported by WordfenceMedium 4.3
- Mar 11, 2024Paid Memberships Pro: Does not prevent user with at least the contributor role from leaking other users' sensitive metadataCVE-2024-1279 · fixed in 2.12.9 · reported by WPScanMedium 4.3
- Jan 24, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-0624 · affects up to 2.12.7 · reported by WordfenceMedium 5.3
- Jan 11, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Unauthorized modification of membership levels created by the pluginCVE-2023-6855 · affects up to 2.12.5 · reported by WordfenceMedium 5.3
- Nov 17, 2023Paid Memberships Pro: Arbitrary file uploadsCVE-2023-6187 · affects up to 2.12.3 · reported by Wordfence51% oddsHigh 7.5
- Oct 20, 2023Paid Memberships Pro: Cross-Site Request ForgeryCVE-2020-36754 · affects up to 2.4.2 · reported by WordfenceMedium 4.3
- Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · fixed in 2.9.12 · reported by WPScan60% oddsHigh 8.8
- Feb 13, 2023Paid Memberships Pro: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4830 · fixed in 2.9.9 · reported by WPScan65% oddsMedium 5.4
- Feb 7, 2022Paid Memberships Pro: Does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statementCVE-2021-25114 · fixed in 2.6.7 · reported by WPScan82% oddsCritical 9.8
- Dec 27, 2021Paid Memberships Pro: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2021-24979 · fixed in 2.6.6 · reported by WPScan1.7% oddsMedium 6.1
- Mar 17, 2021the Paid Memberships Pro versions prior to 2.5.6: SQL injectionCVE-2021-20678 · fixed in 2.5.6 · reported by vultures@jpcert.or.jp2.0% oddsHigh 8.8
- Oct 23, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbCVE-2015-5532 · fixed in 1.8.4.3 · reported by MITRE2.1% oddsMedium 6.1
- Nov 28, 2014Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitraCVE-2014-8801 · fixed in 1.7.15 · reported by MITRE18% oddsMedium 5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.