SQL Injection Vulnerability in Advanced Floating Content Plugin for WordPress

CVE-2024-12031

Summary

The Advanced Floating Content plugin for WordPress is susceptible to SQL injection attacks through the 'floating_content_duplicate_post' function present in all versions up to and including 3.8.2. This vulnerability arises from improper handling of user-supplied parameters, leading to insufficient escaping and inadequate preparation of SQL queries. As a result, authenticated attackers with subscriber-level access or higher can inject additional SQL commands into existing queries, compromising the confidentiality and integrity of sensitive data stored in the database. It is crucial for users of the plugin to apply necessary security measures and updates to protect against potential exploitation.

References