Unauthenticated SQL Injection Vulnerability in Create by Mediavine Plugin for WordPress

CVE-2024-1711

What is CVE-2024-1711?

The Mediavine Create plugin for WordPress is susceptible to an SQL Injection vulnerability via the 'id' parameter. All versions up to and including 1.9.4 are affected. The vulnerability arises from inadequate escaping of user-supplied parameters, coupled with a lack of sufficient preparation in the existing SQL query. This exploit enables unauthorized attackers to append additional SQL queries into the existing queries, potentially allowing them to extract sensitive data from the database. Users of the affected plugin should take immediate action to mitigate risks related to sensitive data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References