Description

WordPress Plugin MainWP Child Reports is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin MainWP Child Reports version 2.0.7 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.0.8 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:132118AA-4B72-4EAA-8AA1-6AD7B0C7F495

https://plugins.svn.wordpress.org/mainwp-child-reports/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Floating Chat Widget:Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button-Chaty Multiple Cross-Site Scripting Vulnerabilities (2.8.3)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-3672)

WordPress Plugin Deny All Firewall Cross-Site Request Forgery (1.1.6)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-16850)

Ruby Inadequate Encryption Strength Vulnerability (CVE-2011-4121)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection CWE-89 CVE-2021-24754