Unauthenticated SQL Injection Vulnerability in UsersWP Plugin for WordPress
CVE-2024-6265
9.8CRITICAL
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 29 June 2024
Summary
The UsersWP plugin for WordPress has a vulnerability that arises from inadequate escaping of user input received via the ‘uwp_sort_by’ parameter. This flaw allows unauthenticated attackers to perform time-based SQL injection, leading to the possibility of injecting arbitrary SQL queries. Such an exploitation could result in unauthorized access to sensitive information stored in the database. All versions of the plugin up to and including 1.2.10 are affected, necessitating prompt action to secure the installation.
Affected Version(s)
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress * <= 1.2.10
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Trương Hữu Phúc (truonghuuphuc)