SQL Injection Vulnerability in NewStatPress Plugin for WordPress
CVE-2015-4062

Currently unrated

Key Information:

Vendor
Wordpress
Status
Newstatpress
Vendor
CVE Published:
27 May 2015

Summary

An SQL injection vulnerability exists in the NewStatPress plugin for WordPress, specifically in the includes/nsp_search.php file. This flaw allows remote authenticated users to execute arbitrary SQL commands by manipulating the 'where1' parameter on the nsp_search page. Proper validation and sanitization of user input are crucial to prevent unauthorized database access and potential data exposure.

References

http://packetstormsecurity.com/files/132038/WordPress-New...
x_refsource_MISC
https://wordpress.org/plugins/newstatpress/changelog/
x_refsource_CONFIRM
http://www.securityfocus.com/bid/74773
vdb-entryx_refsource_BID

EPSS Score

34% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.