WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
CVE-2023-32590

9.3CRITICAL

Key Information:

Vendor
WordPress
Status
Subscribe to Category
Vendor
CVE Published:
20 December 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Subscribe to Category plugin, developed by Daniel Söderström and Sidney van de Stouwe, contains a security vulnerability that permits improper neutralization of special elements used in SQL commands. This flaw enables attackers to exploit SQL Injection techniques, potentially allowing unauthorized access to sensitive data. It is critical for users of Subscribe to Category, versions n/a through 2.7.4, to apply available patches to safeguard their WordPress environments against exploitation.

Affected Version(s)

Subscribe to Category <= 2.7.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-32590
Created by RandomRobbieBF

References

https://patchstack.com/database/vulnerability/subscribe-t...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.