SQL Injection Vulnerability in Thumbnail Slider With Lightbox Plugin for WordPress

CVE-2015-10146

What is CVE-2015-10146?

The Thumbnail Slider With Lightbox plugin for WordPress suffers from a SQL Injection vulnerability due to insufficient input escaping for the 'id' parameter in all versions up to 1.0.4. This flaw enables authenticated attackers, specifically those with Administrator-level access, to inject malicious SQL queries. By exploiting this vulnerability, attackers can manipulate database queries to extract sensitive information, posing a significant risk to the integrity and confidentiality of the data stored within the database.

References