SQL Injection Vulnerability Affects WPExperts Square For GiveWP
CVE-2024-47338

7.6HIGH

Key Information:

Vendor
WordPress
Status
WPexperts Square For GiveWP
Vendor
CVE Published:
6 October 2024

Summary

An SQL Injection vulnerability exists in the WPExperts Square for GiveWP plugin, specifically affecting versions up to 1.3. This flaw arises from improper neutralization of special elements used in SQL commands, allowing attackers to execute arbitrary SQL queries. Exploiting this vulnerability could lead to unauthorized data access, data manipulation, or exposure of sensitive information. Website administrators are strongly advised to implement the latest security patches and update to the most secure version of the plugin to mitigate potential risks.

Affected Version(s)

WPExperts Square For GiveWP <= 1.3

References

https://patchstack.com/database/vulnerability/wpexperts-s...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jorge Diaz - ddiax (Patchstack Alliance)
.