SQL Injection Vulnerability in WPExperts Square For GiveWP Plugin

CVE-2024-13713

What is CVE-2024-13713?

The WPExperts Square For GiveWP plugin for WordPress suffers from a SQL injection vulnerability in the 'post' parameter. This issue arises from inadequate escaping of user input and insufficient preparation of SQL queries. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to insert malicious SQL queries. Such actions may lead to unauthorized access to sensitive data stored in the database, posing significant security risks to WordPress sites utilizing this plugin.

References