Unauthorized SQL Query Injection Vulnerability in View Counter plugin for WordPress
CVE-2016-15040

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Kento Post View Counter
Vendor
CVE Published:
16 October 2024

What is CVE-2016-15040?

The Kento Post View Counter plugin for WordPress contains a vulnerability that exposes it to SQL Injection attacks. Specifically, the 'kento_pvc_geo' parameter is susceptible due to inadequate escaping of user-supplied input and insufficient preparation in the SQL query. This allows unauthenticated attackers to inject malicious SQL queries into existing ones, potentially leading to unauthorized access and extraction of sensitive data from the database. Users of the affected plugin version 2.8 and earlier should take immediate action to secure their installations.

Affected Version(s)

Kento Post View Counter * <= 2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/kento-post-vie...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.