Time-Based SQL Injection Vulnerability in WP Docs Plugin for WordPress
CVE-2024-12635
6.5MEDIUM
Summary
The WP Docs plugin for WordPress has a significant security flaw identified as CVE-2024-12635, which allows for time-based SQL Injection through the 'dir_id' parameter. This vulnerability exists due to insufficient escaping of user-supplied input and a lack of proper query preparation. Authenticated attackers with Subscriber-level access or higher can exploit this weakness to inject additional SQL queries into existing ones, potentially extracting sensitive data from the database. Although a partial patch was introduced in version 2.2.0, users are urged to take full precautions by updating to the latest version to mitigate any risks associated with this vulnerability.
Affected Version(s)
WP Docs * <= 2.2.0
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Arkadiusz Hydzik