WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

CVE-2023-5203

Summary

The WP Sessions Time Monitoring Full Automatic plugin for WordPress prior to version 1.0.9 is susceptible to blind time-based SQL injection. This vulnerability arises from the failure to sanitize request URLs or query parameters before their incorporation into SQL queries. As a result, unauthenticated attackers can exploit this weakness to extract sensitive data from the database through techniques such as blind time-based SQL injection or, in certain scenarios, error/union-based attacks.

References