# CVE-2020-37244: Supsystic Membership SQL injection in badges module

Source: https://junglewise.ai/threats/cve-2020-37244-supsystic-membership-sql-injection-in-badges-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-16. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2020-37244 · Severity: high · CVSS 8.2 · Published 2026-05-16

The Supsystic Membership plugin for WordPress, which provides membership and community features for websites, contains a security flaw in its badges module. An unauthenticated attacker can exploit this vulnerability to run unauthorized database commands. This could lead to the theft of sensitive user information, site configuration data, or other private records stored in the website's database.

Vendors: [Supsystic](https://junglewise.ai/threats/vendors/supsystic).

## Quick answers

**Is CVE-2020-37244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37244 being exploited in the wild.

**How severe is CVE-2020-37244?** High severity, with a CVSS score of 8.2, published 16 May 2026.

**Which products and versions are affected?** Supsystic Membership by Supsystic <= 1.4.7.

**Is there a fix for CVE-2020-37244?** A patch was published on 2020-12-22: Vulnerability fixed in plugin repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-37244 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-37244?** Check whether you run Supsystic Membership by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in the Supsystic Membership plugin for WordPress (version 1.4.7 and below) due to improper neutralization of user-supplied input in the 'search' and 'sidx' GET parameters. The flaw is located within the badges module's 'getTblList' route. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests to the WordPress backend. Successful exploitation allows for time-based blind or UNION-based SQL injection, enabling the attacker to extract sensitive information from the database. The vulnerability was reportedly fixed following coordination with the WordPress Plugin Security team in December 2020.

## Affected products

- Supsystic Membership by Supsystic <= 1.4.7

## Timeline

- 2020-07-25: other: Vendor notified
- 2020-12-22: patched: Vulnerability fixed in plugin repository
- 2021-02-08: disclosed: Exploit-DB proof of concept published
- 2026-05-16: advisory: NVD/VulnCheck advisory published

## References

- [https://downloads.wordpress.org/plugin/membership-by-supsystic.1.4.7.zip](https://downloads.wordpress.org/plugin/membership-by-supsystic.1.4.7.zip)
- [https://supsystic.com/](https://supsystic.com/)
- [https://www.exploit-db.com/exploits/49540](https://www.exploit-db.com/exploits/49540)
- [https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-membership-sql-injection-via-sidx](https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-membership-sql-injection-via-sidx)