CVE-2015-9466

Name of the Vulnerable Software and Affected Versions wti-like-post plugin versions prior to 1.4.3

Description The issue concerns SQL injection via the HTTP CLIENT IP, HTTP X FORWARDED FOR, HTTP X FORWARDED, HTTP FORWARDED FOR, or HTTP FORWARDED variable in the WtiLikePostProcessVote function.

Recommendations For versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the WtiLikePostProcessVote function until a patch is available. Avoid using the variables HTTP CLIENT IP, HTTP X FORWARDED FOR, HTTP X FORWARDED, HTTP FORWARDED FOR, or HTTP FORWARDED in the affected function until the issue is resolved.