Tamir Tsegaye

Name of the Vulnerable Software and Affected Versions: Accredible Certificates & Open Badges plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to time-based SQL Injection via the `orderby` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with Administrator-level access and above to append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database. Recommendations: For versions up to, and including, 1.4.9, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the `orderby` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Multilevel Referral Affiliate Plugin for WooCommerce versions up to 2.27 **Description** The issue allows authenticated attackers with Subscriber-level access and above to inject SQL queries, potentially extracting sensitive information from the database. This is due to insufficient escaping on the `orderby` parameter and lack of preparation on the existing SQL query. **Recommendations** For versions up to 2.27, consider restricting access to the `orderby` parameter in the affected API endpoint until a patch is available. As a temporary workaround, restrict database access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.