SQL Injection Vulnerability in Simple Membership User Import Plugin for WordPress
CVE-2023-0254
4.9MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 12 January 2023
What is CVE-2023-0254?
The Simple Membership WP User Import plugin for WordPress has a vulnerability that allows for SQL Injection through the 'orderby' parameter. This occurs in versions up to and including 1.7 due to inadequate escaping of user-supplied input. Authenticated attackers with administrative access can exploit this flaw to inject additional SQL queries, potentially compromising the database and exposing sensitive information. Website administrators should take immediate action to address this vulnerability by updating to the latest version of the plugin to ensure their systems remain secure.
Affected Version(s)
Simple Membership WP user Import * <= 1.7