SQL Injection Vulnerability in Passwords Manager Plugin for WordPress

CVE-2024-12615

What is CVE-2024-12615?

The Passwords Manager plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and above to perform SQL Injection attacks. This occurs through inadequate escaping of user-supplied data and insufficient preparation of SQL queries in several AJAX actions. Attackers can inject additional SQL queries, potentially leading to the extraction of sensitive information from the database. This vulnerability impacts all versions of the plugin up to and including version 1.4.8, highlighting the need for urgency in applying necessary patches and updates to secure web applications.

References