PT-2024-39139 · WordPress · Mdtf

Krzysztof Zając

·

Published

2024-09-23

·

Updated

2024-10-07

·

CVE-2024-8624

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to, and including, 1.3.3.3
Description: The issue is related to SQL Injection via the meta key attribute of the mdf select title shortcode. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with Contributor-level access and above can append additional SQL queries into already existing queries to extract sensitive information from the database.
Recommendations: For MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to, and including, 1.3.3.3, upgrade to version 1.3.3.4 to protect sensitive data. As a temporary workaround, consider restricting access to the mdf select title shortcode to minimize the risk of exploitation. Avoid using the meta key attribute in the affected shortcode until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8624

Affected Products

Mdtf