Time-Based SQL Injection Vulnerability in BP Profile Shortcodes Extra Plugin

CVE-2024-11732

Summary

The BP Profile Shortcodes Extra plugin for WordPress is susceptible to time-based SQL injection due to inadequate escaping on user-supplied parameters, particularly the ‘tab’ parameter. This vulnerability affects all versions up to and including 2.6.0. Authenticated attackers with Contributor-level access or higher can exploit this weakness to inject additional SQL queries into existing queries. Such an attack can lead to unauthorized access and extraction of sensitive data from the database, raising serious concerns about data security and integrity.

References