SQL Injection Vulnerability in WordPress HelpDesk & Support Plugin

CVE-2024-0594

What is CVE-2024-0594?

The Awesome Support – WordPress HelpDesk & Support Plugin is susceptible to union-based SQL Injection through the 'q' parameter of the wpas_get_users action. This vulnerability arises from inadequate escaping of user-supplied inputs and insufficient preparation within the SQL query. Authenticated attackers with subscriber-level access and above can exploit this flaw to inject additional SQL commands surrounding existing queries, thereby gaining access to sensitive data stored in the database. Users of all versions up to and including 6.1.7 are at risk, prompting urgent attention to mitigate potential data breaches.

References