PT-2020-15272 · WordPress · Sliced Invoices Plugin

Published 2020-08-31 · Updated 2020-09-04 · CVE-2020-20625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sliced Invoices plugin for WordPress versions 3.8.2 and earlier

Description The issue allows for unauthenticated information disclosure and authenticated SQL injection. This is due to a problem in the core/class-sliced.php file.

Recommendations For Sliced Invoices plugin for WordPress versions 3.8.2 and earlier, update to a version later than 3.8.2 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-20625

Affected Products

Sliced Invoices Plugin

References · 3

• 🔥 https://blog.nintechnet.com/multiple-vulnerabilities-in-sliced-invoices-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2020-20625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20625 · Security Note