PT-2026-6886 · WordPress · Bucketlister

Ivan Cese · Publicado 2026-02-07 · Atualizado 2026-02-07 · CVE-2025-15477

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bucketlister plugin for WordPress versions up to and including 0.1.5

Description The software contains a SQL Injection issue through the category and id attributes within its shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query allow authenticated attackers with Contributor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database. The vulnerable parameters are category and id.

Recommendations Update the Bucketlister plugin to a version beyond 0.1.5.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-15477

Produtos afetados

Bucketlister

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-15477 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/the-bucketlister/tags/0.1.5/bucketlister.php#L19 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/fba36ebc-a396-4eb8-8cb6-afc50b9c974e?source=cve · Nota
• https://twitter.com/CVEnew/status/2020060997700972932 · Publicação no Twitter
• https://t.me/cveNotify/151242 · Publicação no Telegram
• https://t.me/CVEtracker/44030 · Publicação no Telegram