PT-2022-9482 · WordPress · Cookie Notification Plugin

Shreya Pohekar · Published 2022-01-24 · Updated 2022-01-27 · CVE-2021-24858

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cookie Notification Plugin for WordPress versions prior to 1.0.9

Description The issue concerns an authenticated SQL Injection. It occurs because the id GET parameter is not properly sanitised or escaped before being used in a SQL statement. This happens when retrieving settings to edit in the admin dashboard.

Recommendations For versions prior to 1.0.9, update to version 1.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24858

Affected Products

Cookie Notification Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/9bd1c040-09cc-4c2d-88c9-8406a653a48b · Exploit
• https://osv.dev/vulnerability/CVE-2021-24858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24858 · Security Note
• https://t.me/cibsecurity/36101 · Telegram Post