Description
Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin Payment Form for PayPal Pro SQL Injection (1.1.64)
WordPress Plugin InstaWP Connect-1-click WP Staging & Migration Security Bypass (0.1.0.44)
WordPress Ultimate Member Plugin CVE-2020-36170 Vulnerability (CVE-2020-36170)
MySQL CVE-2016-0662 Vulnerability (CVE-2016-0662)
WordPress Plugin Advanced Custom Fields PRO Arbitrary File Upload (5.12.2)