EazyDocs < 2.3.4 - Subscriber + SQLi

CVE-2023-6035

Summary

The EazyDocs WordPress plugin prior to version 2.3.4 is susceptible to an SQL injection vulnerability due to inadequate sanitization and escaping of the 'data' parameter. When processed through an AJAX action, this flaw enables any authenticated user, including those with subscriber roles, to leverage this weakness and potentially execute malicious SQL commands. This could lead to unauthorized access to sensitive information stored in the database, posing a significant risk to the integrity and confidentiality of the data.

References