SQL Injection Vulnerability in Ebook Downloader Plugin for WordPress

CVE-2024-13435

What is CVE-2024-13435?

The Ebook Downloader plugin for WordPress is susceptible to SQL Injection due to improper escaping of the 'download' parameter across all versions up to and including 1.0. This vulnerability allows unauthenticated attackers to insert arbitrary SQL statements into existing queries, potentially leading to unauthorized access to sensitive database information. Ensuring secure coding practices and sanitizing user inputs are critical to prevent exploitation of this vulnerability.

References