PT-2023-16820 · WordPress · Http Headers

Qerogram · Published 2023-05-15 · Updated 2025-01-24 · CVE-2023-1207

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTTP Headers WordPress plugin versions prior to 1.18.8

Description The issue concerns an import functionality in the HTTP Headers WordPress plugin that executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. This allows for potential exploitation by executing unauthorized SQL commands.

Recommendations For versions prior to 1.18.8, update to version 1.18.8 or later to resolve the issue. As a temporary workaround, consider disabling the import functionality until a patch is available. Restrict access to the import feature to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-1207

Affected Products

Http Headers

References · 5

• 🔥 https://wpscan.com/vulnerability/6f3f460b-542a-4d32-8feb-afa1aef57e37 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-1207 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1207 · Vendor Advisory
• https://t.me/cibsecurity/64135 · Telegram Post
• https://t.me/cvenotify/108545 · Telegram Post