SQL Injection in WordPress Project Manager Plugin
CVE-2024-12015

7.7HIGH

Key Information:

Vendor
Wordpress
Status
WP Project Manager
Vendor
CVE Published:
2 December 2024

Summary

The Project Manager WordPress Plugin is susceptible to an authenticated SQL injection vulnerability, specifically in the 'orderby' parameter within the '/pm/v2/activites' endpoint. This flaw allows authenticated users to manipulate SQL queries, potentially leading to unauthorized data exposure or modification. It is crucial for users of the affected plugin versions to apply security best practices and consider updates to mitigate potential threats.

Affected Version(s)

WP Project Manager 0

References

https://www.tenable.com/security/research/tra-2024-47

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.