SQL Injection Vulnerability in WP SMS Plugin for WordPress
CVE-2023-6981
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 January 2024
What is CVE-2023-6981?
The WP SMS plugin for WordPress, which facilitates messaging and SMS notifications for various platforms such as WooCommerce and GravityForms, is exposed to a SQL Injection vulnerability. This issue arises from inadequate escaping of user-supplied input in the 'group_id' parameter. Authenticated attackers with contributor access can manipulate SQL queries, potentially leading to the extraction of confidential information from the database. Additionally, this vulnerability can be exploited to execute Reflected Cross-site Scripting attacks, heightening security risks for affected WordPress sites.
Affected Version(s)
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc * <= 6.5