PT-2024-39231 · WordPress · Wp Post Author

Lesor101

·

Published

2024-10-12

·

Updated

2024-10-17

·

CVE-2024-8757

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress versions up to, and including, 3.8.1
Description: The issue is related to time-based SQL Injection via the linked user id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Recommendations: For versions up to, and including, 3.8.1, consider disabling the linked user id parameter until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of sensitive information extraction. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8757

Affected Products

Wp Post Author