CVE-2020-37244

WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx

High8.8Public exploitEPSS 0.28%

Published: 16 May 2026
Updated: 28 Jul 2026
Reserved: 16 May 2026
Assigned by: VulnCheck

Description

Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-49540 (opens in a new tab)exploit

Timeline

2026
16 May 2026
16 May 2026
ID reserved
By VulnCheck
16 May 2026
16 May 2026
Published
28 Jul 20262 months later
28 Jul 2026· 2 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-37244, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Deferred	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.28% · top 80% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

Supsystic · Membership
- affected 1.4.7

References (4)

ExploitDB-49540 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
VulnCheck Advisory: WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-37244](https://trackcve.app/badge/CVE-2020-37244.svg)](https://trackcve.app/cve/CVE-2020-37244)

Record last updated 28 Jul 2026, 01:47 UTC.