Description
WordPress Plugin Mingle Forum is prone to multiple SQL injection vulnerabilities and a security-bypass vulnerability because it fails to adequately sanitize user-supplied input. Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks. WordPress Plugin Mingle Forum versions 1.0.24 and 1.0.26 are vulnerable; other versions may also be affected.
Remediation
Update to plugin version 1.0.27 or latest
References
http://www.securityfocus.com/bid/45733/exploit
http://www.charleshooper.net/blog/multiple-vulnerabilities-in-mingle-forum-wordpress-plugin/
Related Vulnerabilities
WebLogic CVE-2023-21931 Vulnerability (CVE-2023-21931)
Serendipity Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-5475)
WordPress Plugin Favicon by RealFaviconGenerator Unspecified Vulnerability (1.2.13)
MySQL CVE-2019-2593 Vulnerability (CVE-2019-2593)
WordPress Plugin WooCommerce Checkout Manager Cross-Site Request Forgery (4.3)