PT-2026-71507
CVE-2026-28002
·
تاريخ النشر
2026-08-12
·
تاريخ التحديث
2026-10-23
الوصف من
CVSS 3.1
8.5
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Name of the Vulnerable Software and Affected Versions
Booktics versions prior to 1.0.23
Description
An SQL Injection flaw exists in the Booktics plugin for WordPress. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. This allows for Blind SQL Injection, which can be used to extract sensitive information from the database.
Recommendations
Update to a version newer than 1.0.22.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾