Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-1002009: Membership Simplified plugin can let attackers delete data
CVE-2017-1002009 · published 9 years ago
Summary
The Membership Simplified WordPress plugin (version 1.58) runs a database update script that accepts a record identifier without checking it first. This lets a malicious user send specially crafted requests that can delete or change information in the site’s database. Update the plugin to a patched version or disable/remove it until the code is fixed, and monitor the database for unexpected changes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ontraport | membership_simplified |
1.58 cpe:2.3:a:ontraport:membership_simplified:1.58:*:*:*:*:wordpress:*:* |
Original advisory text
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize u...
Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.
References
- http://membership.officeautopilot.com/get-it-now/ Not Applicable
- http://www.vapidlabs.com/advisory.php?v=188 Exploit Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published14 Sep 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-1002009 · NVD
Track software like this
Free during beta