PT-2023-10012 · WordPress · Editorial Calendar Plugin

Published 2023-04-08 · Updated 2024-05-17 · CVE-2013-10023

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Editorial Calendar Plugin versions up to 2.6

Description A critical issue has been found in the Editorial Calendar Plugin, affecting the function edcal filter where of the file edcal.php. The manipulation of the arguments edcal startDate and edcal endDate leads to SQL injection. This issue can be exploited remotely. Upgrading to version 2.7 addresses this issue.

Recommendations For Editorial Calendar Plugin versions up to 2.6, upgrade to version 2.7 to resolve the issue. As a temporary workaround, consider restricting the use of the edcal filter where function in the edcal.php file until the upgrade is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-10023

Affected Products

Editorial Calendar Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2013-10023 · Security Note
• https://github.com/wp-plugins/editorial-calendar/commit/a9277f13781187daee760b4dfd052b1b68e101cc · Patch
• https://github.com/wp-plugins/editorial-calendar/releases/tag/2.7 · Patch
• https://vuldb.com/?id.225151 · Note
• https://t.me/cvenotify/47812 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-10023 · Note
• https://vuldb.com/?ctiid.225151 · Note
• https://t.me/cvenotify/48434 · Telegram Post