CVE-2021-38324

Name of the Vulnerable Software and Affected Versions: SP Rental Manager WordPress plugin versions up to and including 1.5.3

Description: The issue allows attackers to retrieve information contained in a site's database via SQL Injection. This is possible due to the vulnerability in the orderby parameter found in the ~/user/shortcodes.php file.

Recommendations: For versions up to and including 1.5.3, update to a version later than 1.5.3 to resolve the issue. As a temporary workaround, consider restricting access to the ~/user/shortcodes.php file or avoiding the use of the orderby parameter in the affected endpoint until a patch is available.