WordPress Simple HTML Sitemap Plugin Vulnerable to SQL Injection
CVE-2024-7385
9.1CRITICAL
What is CVE-2024-7385?
The Simple HTML Sitemap plugin for WordPress is exposed to SQL Injection attacks due to inadequate parameter escaping on the 'id' parameter and a failure to properly prepare existing SQL queries. This vulnerability allows authenticated users with Administrator-level access and above to insert harmful SQL queries into valid ones, potentially leading to unauthorized exposure of sensitive database information. Website administrators should review their configurations and implement necessary updates to mitigate risks associated with this plugin.
Affected Version(s)
WP Simple HTML Sitemap 0 <= 3.1
References
EPSS Score
13% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
anhchangmutrang