Sensitive Information at Risk: SQL Injection Vulnerability in Responsive Filterable Portfolio Plugin

CVE-2019-25221

Summary

The Responsive Filterable Portfolio plugin for WordPress is susceptible to SQL Injection attacks through the 'id' parameter in all versions up to 1.0.8. This vulnerability arises from inadequate escaping of user-supplied data and lack of proper SQL query preparation. As a result, unauthenticated attackers can manipulate existing SQL queries by injecting additional commands, potentially leading to unauthorized access and extraction of sensitive information from the database. Regular updates and proper configuration are crucial to mitigate such vulnerabilities.

References