SQL Injection Vulnerability in Simple Membership User Import Plugin for WordPress
CVE-2023-0254

4.9MEDIUM

Key Information:

Vendor
Wordpress
Status
Simple Membership WP user Import
Vendor
CVE Published:
12 January 2023

Summary

The Simple Membership WP User Import plugin for WordPress has a vulnerability that allows for SQL Injection through the 'orderby' parameter. This occurs in versions up to and including 1.7 due to inadequate escaping of user-supplied input. Authenticated attackers with administrative access can exploit this flaw to inject additional SQL queries, potentially compromising the database and exposing sensitive information. Website administrators should take immediate action to address this vulnerability by updating to the latest version of the plugin to ensure their systems remain secure.

Affected Version(s)

Simple Membership WP user Import * <= 1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Etan Imanol Castro Aldrete
.