SQL Injection Vulnerability in Intuitive Custom Post Order Plugin for WordPress

CVE-2023-1016

What is CVE-2023-1016?

The Intuitive Custom Post Order plugin for WordPress has a vulnerability that allows authenticated attackers with administrator permissions to exploit SQL Injection. The flaw is due to inadequate escaping of user-supplied parameters, specifically 'objects' and 'tags', in conjunction with insufficiently prepared queries in the 'update_options' and 'refresh' functions. This exploitation can allow attackers to append malicious SQL queries, potentially revealing sensitive information stored in the database. This vulnerability poses a significant risk, especially in environments where characteristics like character sets can lead to query manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References