WordPress BSK Forms Blacklist Plugin <= 3.6.2 is vulnerable to SQL Injection
CVE-2023-30872

7.6HIGH

Key Information:

Vendor
WordPress
Status
BSK Forms Blacklist
Vendor
CVE Published:
20 December 2023

Summary

The BSK Forms Blacklist plugin by BannerSky is vulnerable to SQL Injection, allowing attackers to execute arbitrary SQL queries through improperly sanitized user inputs. This issue affects versions from previous releases through 3.6.2, potentially compromising the integrity of the database and exposing sensitive information.

Affected Version(s)

BSK Forms Blacklist <= 3.6.2

References

https://patchstack.com/database/vulnerability/bsk-gravity...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TomS (Patchstack Alliance)
.