SQL Injection Vulnerability in GigPress Plugin for WordPress

CVE-2015-4066

Summary

Multiple SQL injection vulnerabilities exist in the GigPress plugin for WordPress, specifically found in admin/handlers.php, prior to version 2.3.9. These vulnerabilities allow remote authenticated users to run arbitrary SQL commands using the (1) show_artist_id or (2) show_venue_id parameters when adding actions on the gigpress.php page in the WordPress admin interface. This could potentially lead to unauthorized database manipulation and information disclosure, emphasizing the need for immediate vulnerability management and mitigation strategies.

References