Database read and write via discount code injection

SQL injection in Paid Memberships Pro before 2.3.3 allows remote authenticated users with administrator rights to read or alter database data. Public advisories identify the discount_code_id parameter in adminpages/orders.php as the injection locus but do not disclose the query construction defect. Access to the plugin's administrative orders page is required; successful exploitation permits database reads and writes through arbitrary SQL commands.