SQL Injection Vulnerability in Thumbnail Carousel Slider Plugin for WordPress

CVE-2019-25222

What is CVE-2019-25222?

The Thumbnail Carousel Slider Plugin for WordPress is susceptible to SQL injection attacks through the 'id' parameter. This vulnerability arises from inadequate escaping of user-supplied input and a lack of proper SQL query preparation in versions up to and including 1.0.4. Attackers, who do not require authentication, can exploit this flaw to execute malicious SQL commands, potentially accessing sensitive information stored in the database.

References