SQL Injection Vulnerability in MotoPress Timetable Plugin Affects Sensitive Data

CVE-2024-3342

What is CVE-2024-3342?

The Timetable and Event Schedule by MotoPress plugin for WordPress is susceptible to SQL Injection through the 'events' attribute of the 'mp-timetable' shortcode. This vulnerability exists in all versions up to and including 2.4.11 due to inadequate escaping of user-supplied parameters and insufficient safeguards in the SQL query construction. Authenticated attackers with contributor-level access can exploit this vulnerability to insert additional SQL queries, potentially leading to the unauthorized extraction of sensitive data from the database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References