PT-2022-9664 · WordPress · Futurio Extra

Jan W Oleju · Published 2022-02-14 · Updated 2022-02-22 · CVE-2021-25109

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Futurio Extra WordPress plugin versions prior to 1.6.3

Description The issue allows high privilege users to extract data from the database and perform Cross-Site Scripting (XSS) against logged in admins by making them open a malicious link. This is due to a SQL Injection vulnerability.

Recommendations For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for high privilege users until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-25109

Affected Products

Futurio Extra

References · 4

• 🔥 https://wpscan.com/vulnerability/36261af9-3b34-4563-af3c-c9e54ae2d581 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25109 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25109 · Vendor Advisory
• https://t.me/cibsecurity/37402 · Telegram Post