The vulnerability is an SQL injection flaw in the Cozmoslabs Paid Member Subscriptions plugin. An attacker can craft input that bypasses the plugin’s input sanitization and inject arbitrary SQL commands, allowing unauthorized reading, modification, or deletion of database data. The flaw is catalogued as CWE‑89.

WordPress sites that have installed the Paid Member Subscriptions plugin from its earliest release through version 2.15.1, all maintained by Cozmoslabs, are affected. Any deployment of these plugin versions that is publicly accessible or has exposed endpoints is vulnerable.

The CVSS score of 7.5 indicates a high severity exploitation potential. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current likelihood of exploitation, but the ease of the injection path—through user‑controllable plugin parameters—means an attacker with internet access could craft a request to trigger the flaw. The attack vector is inferred to be via the plugin’s web interface, and no additional conditions are specified, making the exploit straightforward once the plugin is activated.