PT-2023-16114 · WordPress · Simple Membership Wp User Import

Etan Imanol Castro Aldrete · Published 2023-01-12 · Updated 2023-01-20 · CVE-2023-0254

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7

Description The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables authenticated attackers with administrative privileges to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommendations For versions up to, and including, 1.7, consider disabling the orderby parameter until a patch is available to prevent SQL Injection attacks. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the orderby parameter in the affected plugin until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-0254

Affected Products

Simple Membership Wp User Import

References · 6

• https://osv.dev/vulnerability/CVE-2023-0254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0254 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9 · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail= · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9?source=cve · Note
• https://t.me/cibsecurity/56439 · Telegram Post