SQL Injection Vulnerability in Verowa Connect Plugin for WordPress
CVE-2024-11460

7.5HIGH

Key Information:

Vendor

Wordpress
Status
Verowa Connect
Vendor
CVE Published:
6 December 2024

What is CVE-2024-11460?

The Verowa Connect plugin for WordPress is exposed to a SQL Injection vulnerability through the 'search_string' parameter in all versions up to and including 3.0.1. This weakness arises from insufficient escaping of user-supplied input and inadequate preparation of the SQL query. Consequently, unauthenticated attackers could craft malicious inputs to inject additional SQL queries into existing ones, potentially leading to unauthorized access and extraction of sensitive data from the database.

Affected Version(s)

Verowa Connect * <= 3.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/verowa-connect...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Colin Xu
JSON
.