Time-Based SQL Injection Vulnerability in WP Docs Plugin for WordPress

CVE-2024-12635

What is CVE-2024-12635?

The WP Docs plugin for WordPress has a significant security flaw identified as CVE-2024-12635, which allows for time-based SQL Injection through the 'dir_id' parameter. This vulnerability exists due to insufficient escaping of user-supplied input and a lack of proper query preparation. Authenticated attackers with Subscriber-level access or higher can exploit this weakness to inject additional SQL queries into existing ones, potentially extracting sensitive data from the database. Although a partial patch was introduced in version 2.2.0, users are urged to take full precautions by updating to the latest version to mitigate any risks associated with this vulnerability.

References