PT-2021-16071 · WordPress · Edit Comments Wordpress Plugin

Shreya Pohekar · Published 2021-08-23 · Updated 2021-08-26 · CVE-2021-24551

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Edit Comments WordPress plugin versions 0.3 and earlier

Description The issue arises from the lack of sanitization, validation, or escaping of the jal edit comments GET parameter before its use in a SQL statement, leading to a SQL injection issue.

Recommendations For Edit Comments WordPress plugin versions 0.3 and earlier, update to a version that properly sanitizes, validates, or escapes the jal edit comments GET parameter to prevent SQL injection.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24551

Affected Products

Edit Comments Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/e62fb8db-384f-4384-ad24-e10eb9058ed5 · Exploit
• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-edit-comments · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24551 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24551 · Vendor Advisory
• https://t.me/cibsecurity/27696 · Telegram Post
• https://t.me/cvenotify/20207 · Telegram Post