Description

WordPress Plugin WP Data Access is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin WP Data Access version 4.3.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.0.0 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:A9073616-FFD6-4956-B2E7-0FB2EAC6E9B5

Related Vulnerabilities

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-6896)

Varnish Cache Integer Overflow or Wraparound Vulnerability (CVE-2017-12425)

Apache HTTP Server Other Vulnerability (CVE-2004-0811)

WordPress Plugin Import any XML or CSV File to WordPress Cross-Site Scripting (3.4.6)

Opencart Improper Restriction of XML External Entity Reference Vulnerability (CVE-2014-3990)

Severity

High

Classification

CVE-2021-24866 CWE-89 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection