CVE-2015-2065

Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery (contus-video-gallery) plugin versions prior to 2.8

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the vid parameter in a 'rss' action to the "/wp-admin/admin-ajax.php" API endpoint.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-admin/admin-ajax.php" API endpoint for the 'rss' action to minimize the risk of exploitation. Avoid using the vid parameter in the affected API endpoint until the issue is resolved.