PT-2024-12104
CVE-2023-2655
·
تاريخ النشر
2024-01-16
·
تاريخ التحديث
2024-01-23
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
The Contact Form by WD WordPress plugin versions 1.13.23 and earlier
Description
The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement. This can be exploited by high privilege users, such as admins.
Recommendations
For versions 1.13.23 and earlier, update to a version later than 1.13.23 to resolve the issue. As a temporary workaround, consider restricting access to high privilege users until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾