PT-2021-16145 · WordPress · Post Content Xmlrpc Wordpress Plugin

Shreya Pohekar · Published 2021-11-08 · Updated 2021-11-10 · CVE-2021-24629

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Post Content XMLRPC WordPress plugin version 1.0

Description The issue concerns an authenticated SQL injection. It occurs because the plugin does not properly sanitise or escape multiple GET and POST parameters, such as username and password, before using them in SQL statements in the admin dashboard. This allows an attacker to inject malicious SQL code.

Recommendations For Post Content XMLRPC WordPress plugin version 1.0, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the admin dashboard to minimize the risk of authenticated SQL injection attacks. Avoid using vulnerable parameters in SQL statements until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24629

Affected Products

Post Content Xmlrpc Wordpress Plugin

References · 4

• 🔥 https://codevigilant.com/disclosure/2021/wp-plugin-post-content-xmlrpc · Exploit
• 🔥 https://wpscan.com/vulnerability/fb42980c-93e5-42d5-a478-c2b348eaea67 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24629 · Security Note