SQL Injection Vulnerability in MDTF Plugin for WordPress
CVE-2024-8624

9.9CRITICAL

Key Information:

Vendor
Wordpress
Status
Mdtf – Meta Data And Taxonomies Filter
Vendor
CVE Published:
24 September 2024

Summary

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress has a vulnerability that allows for SQL Injection through the 'meta_key' attribute of the 'mdf_select_title' shortcode. This vulnerability affects all versions up to and including 1.3.3.3. Due to inadequate escaping of user-provided parameters and a flawed SQL query construction process, authenticated attackers with Contributor-level access or higher can inject additional SQL queries into existing ones. This exploit can potentially lead to unauthorized access and extraction of sensitive information from the WordPress database.

Affected Version(s)

MDTF – Meta Data and Taxonomies Filter * <= 1.3.3.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.