Paid Member Subscriptions plugin: SQL injection by Subscriber accounts
Summary
The WordPress plugin Paid Member Subscriptions up to and including version 3.1.1 contains an SQL injection flaw (CWE-89). An attacker with a logged-in Subscriber account can read, modify or delete database content, which may include member and payment-related data. Sites with open registration are more exposed than sites with invite-only membership. No public proof of concept or known exploitation has been found so far.
Affected
- Paid Member Subscriptions WordPress plugin up to and including 3.1.1
- Exploitation requires a Subscriber account
Fixed in
- Patchstack and the CVE record list 3.1.2 as the patched version.
- The vendor (Cozmoslabs) has not been confirmed as the source of this fix. Verify against the Cozmoslabs changelog.
- A separate issue (CVE-2026-112842, Medium, CVSS 6.5) is reported for versions up to 3.1.2, so install the newest version and check its changelog.
Workaround
- No vendor-published workaround found.
- Until the site is patched, restrict or review new Subscriber registrations and remove unused accounts.
- If you have a Patchstack subscription, check for virtual patches in your web application firewall.
Exploitation
- Not listed as known exploited (CISA KEV: not listed per the sources reviewed).
- EPSS score: 0.28%.
- No public proof of concept found. This does not prove that none exists.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Update the Paid Member Subscriptions plugin to the newest version available, at least 3.1.2, and confirm the fix in the changelog.
- Review and restrict Subscriber registrations and remove unused accounts.
- Check the website database for unexpected changes and review access logs for unusual requests.
- Monitor for public proof of concept or exploitation reports, as the record is new.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability record patchstack.com
- Hol.org CVE-2026-105317 hol.org
- Strix CVE-2026-105317 www.strix.ai
- WPScan plugin overview wpscan.com
- Hol.org CVE-2026-112842 hol.org
- Patchstack article on earlier SQL injection fix patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:24.
Original description (NVD)
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.