Description
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.
Published: 2026-05-16
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Sup Supsystic Membership 1.4.7 contains an SQL injection flaw that allows attackers to send crafted GET requests with malicious payloads in the ‘search’ and ‘sidx’ parameters of the badges module. By exploiting time‑based blind or UNION‑based techniques, an adversary can execute arbitrary SQL statements against the WordPress database, enabling extraction of sensitive data or modification of the database content.

Affected Systems

The vulnerability affects WordPress sites that have the Sup Supsystic Membership plugin, version 1.4.7, installed. Sites running this plugin without an updated version are susceptible.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability with significant impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but its web‑based, unauthenticated nature and lack of authentication requirements make it highly exploitable on exposed WordPress sites. Attackers can target the plugin’s public endpoint, leveraging the injection to extract or alter database contents.

Generated by OpenCVE AI on May 16, 2026 at 16:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Sup Supsystic Membership plugin to the latest version that contains the SQL injection fix.
  • If the plugin is not needed for the site’s functionality, disable or delete it to eliminate the attack surface; otherwise restrict access to the badges module so that only authenticated users can hit the vulnerable parameters.
  • Deploy a web application firewall rule to detect and block suspicious SQL injection patterns in the ‘search’ and ‘sidx’ query parameters.

Generated by OpenCVE AI on May 16, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 16 May 2026 15:45:00 +0000

Type Values Removed Values Added
Description Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.
Title WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-16T15:25:59.342Z

Reserved: 2026-05-16T14:18:12.372Z

Link: CVE-2020-37244

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-16T16:16:20.750

Modified: 2026-05-16T16:16:20.750

Link: CVE-2020-37244

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-16T16:30:27Z

Weaknesses