Administrator SQL Injection Vulnerability in FAQ Manager <= 2.0.3 Versions
CVE-2024-32136

7.6HIGH

Key Information:

Vendor

WordPress
Status
Bwl Advanced Faq Manager
Vendor
CVE Published:
15 April 2024

What is CVE-2024-32136?

Xenioushk BWL Advanced FAQ Manager has a SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows an attacker to execute unauthorized SQL queries, potentially leading to unauthorized data access, data manipulation, and a full compromise of the affected system. Versions affected include all releases up to 2.0.3. It's crucial for users of the BWL Advanced FAQ Manager to patch their installations to mitigate risk and secure their databases against potential exploitation.

Affected Version(s)

BWL Advanced FAQ Manager <= 2.0.3

References

https://patchstack.com/database/vulnerability/bwl-advance...
vdb-entry

EPSS Score

26% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Spiridonov (Patchstack Alliance)
.
CVE-2024-32136 : Administrator SQL Injection Vulnerability in FAQ Manager <= 2.0.3 Versions