SQL Injection Vulnerability in Post SMTP Plugin by Post SMTP
CVE-2024-52436

7.2HIGH

Key Information:

Vendor

WordPress
Status
Post Smtp
Vendor
CVE Published:
18 November 2024

What is CVE-2024-52436?

A vulnerability exists in the Post SMTP Plugin that allows for blind SQL injection attacks due to improper neutralization of special elements used in SQL commands. This issue could potentially allow attackers to manipulate queries made to the database, exposing sensitive data or granting unauthorized access. The vulnerability affects all versions up to and including 2.9.9, urging users to apply patches and updates to secure their installations.

Affected Version(s)

Post SMTP 0 <= 2.9.9

References

https://patchstack.com/database/Wordpress/Plugin/post-smt...
vdb-entry

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.