PT-2023-10301 · WordPress · Most Popular Posts Widget Plugin

Published 2023-10-02 · Updated 2024-05-17 · CVE-2015-10124

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Most Popular Posts Widget Plugin versions up to 0.8

Description A critical issue has been found in the Most Popular Posts Widget Plugin, affecting the add views/show views function of the functions.php file. This issue leads to sql injection and can be exploited remotely.

Recommendations For Most Popular Posts Widget Plugin versions up to 0.8, upgrade to version 0.9 to address this issue. As a temporary workaround, consider disabling the add views/show views function until the patch is applied. Restrict access to the functions.php file to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-10124

Affected Products

Most Popular Posts Widget Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-10124 · Security Note
• https://github.com/wp-plugins/most-popular-posts-widget-lite/commit/a99667d11ac8d320006909387b100e9a8b5c12e1 · Patch
• https://t.me/cibsecurity/71415 · Telegram Post
• https://vuldb.com/?ctiid.241026 · Note
• https://vuldb.com/?id.241026 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10124 · Note