SQL Injection Vulnerability in WPExperts Square For GiveWP Plugin
CVE-2024-13713
6.5MEDIUM
Key Information:
- Vendor
- WPexpertsio
- Status
- WPexperts Square For GiveWP
- Vendor
- CVE Published:
- 21 February 2025
Summary
The WPExperts Square For GiveWP plugin for WordPress suffers from a SQL injection vulnerability in the 'post' parameter. This issue arises from inadequate escaping of user input and insufficient preparation of SQL queries. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to insert malicious SQL queries. Such actions may lead to unauthorized access to sensitive data stored in the database, posing significant security risks to WordPress sites utilizing this plugin.
Affected Version(s)
WPExperts Square For GiveWP * <= 1.3.1
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
F r