Blind SQL Injection Vulnerability in tagDiv Opt-In Builder Plugin

CVE-2023-3419

Summary

The tagDiv Opt-In Builder plugin is susceptible to a Blind SQL Injection vulnerability via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to and including 1.4.4. This vulnerability arises from inadequate user input escaping and insufficient preparation of the SQL query. Authenticated attackers with administrator privileges can exploit this weakness to inject additional SQL queries into existing queries, potentially exposing sensitive information from the underlying database. Maintaining secure coding practices and ensuring thorough input validation are crucial to mitigate such vulnerabilities.

References