CVE-2021-24404

Name of the Vulnerable Software and Affected Versions WP-Board WordPress plugin versions 1.1 beta and earlier

Description The issue concerns the WP-Board WordPress plugin, where the options.php file accepts a postid parameter without proper sanitization, escaping, or validation before inserting it into a SQL statement. This leads to a time-based SQL injection. The vulnerable parameter is passed twice in the same function, resulting in a prolonged response time if a specific time delay is introduced.

Recommendations For WP-Board WordPress plugin versions 1.1 beta and earlier, consider restricting access to the options.php file until a patch is available. As a temporary workaround, avoid using the postid parameter in the affected function until the issue is resolved.