CVE-2021-24858

Name of the Vulnerable Software and Affected Versions Cookie Notification Plugin for WordPress versions prior to 1.0.9

Description The issue concerns an authenticated SQL Injection. It occurs because the id GET parameter is not properly sanitised or escaped before being used in a SQL statement. This happens when retrieving settings to edit in the admin dashboard.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved.