SQL Injection Flaw in FeedWordPress Plugin Affects WordPress Users
CVE-2015-4018

Currently unrated

Key Information:

Vendor

Wordpress
Status
FeedWordPress
Vendor
CVE Published:
21 May 2015

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2015-4018?

A vulnerability exists in the FeedWordPress plugin for WordPress, allowing remote authenticated users to manipulate SQL commands. This flaw is located in the file feedwordpresssyndicationpage.class.php and can be exploited through the link_ids[] parameter during an Update action in syndication.php. By leveraging this vulnerability, malicious users may execute arbitrary SQL queries, potentially leading to unauthorized access and data manipulation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2015-4018 - Proof of Concept

References

https://wordpress.org/plugins/feedwordpress/changelog/
x_refsource_CONFIRM
https://www.exploit-db.com/exploits/37067/
exploitx_refsource_EXPLOIT-DB
http://seclists.org/fulldisclosure/2015/May/75
mailing-listx_refsource_FULLDISC

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.