Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-23488-PoC — Unauthenticated SQL Injection - Paid Memberships Pro < 2.9.8 (WordPress Plugin) | Kitploit
Tools/GitHubGitHub/long-rookie/cve-2023-23488-poc
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHublong-rookie/cve-2023-23488-poc

CVE-2023-23488-PoC

Unauthenticated SQL Injection - Paid Memberships Pro < 2.9.8 (WordPress Plugin)

View Repository
33 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-23488-PoC

Unauthenticated SQL Injection - Paid Memberships Pro < 2.9.8 (WordPress Plugin)

Running this script against a WordPress instance with Paid Membership Pro plugin tells you if the target is vulnerable. As the SQL injection technique required to exploit it is Time-based blind, instead of trying to directly exploit the vuln, it will generate the appropriate sqlmap command to dump the whole database (probably very time-consuming) or specific chose data like usernames and passwords.

Usage example:

root@kitploit:~
python3 CVE-2023-23488.py http://127.0.0.1/wordpress

References

  • Credits to Joshua Martinelle, who discovered the vulnerability
  • Vendor Homepage: https://www.paidmembershipspro.com
  • Vulnerable software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.2.9.7.zip
  • Advisory: https://github.com/advisories/GHSA-pppw-hpjp-v2p9
Download Tool