SQL Injection in WordPress Project Manager Plugin
CVE-2024-12015
7.7HIGH
What is CVE-2024-12015?
The Project Manager WordPress Plugin is susceptible to an authenticated SQL injection vulnerability, specifically in the 'orderby' parameter within the '/pm/v2/activites' endpoint. This flaw allows authenticated users to manipulate SQL queries, potentially leading to unauthorized data exposure or modification. It is crucial for users of the affected plugin versions to apply security best practices and consider updates to mitigate potential threats.
Affected Version(s)
WP Project Manager 0