PT-2025-1774 · WordPress · Wp Project Manager
Trương Hữu Phúc
+1
·
Published
2025-01-04
·
Updated
2025-02-05
·
CVE-2024-12195
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WP Project Manager plugin versions up to and including 2.6.16
Description
The WP Project Manager plugin for WordPress is vulnerable to SQL Injection via the
project id parameter of the "/wp-json/pm/v2/projects/2/task-lists" REST API endpoint. This vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers, who have been granted access to a project, can append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.Recommendations
For WP Project Manager plugin versions up to and including 2.6.16, update to a version later than 2.6.16 to resolve the issue.
As a temporary workaround, consider restricting access to the "/wp-json/pm/v2/projects/2/task-lists" API endpoint until a patch is available.
Avoid using the
project id parameter in the affected API endpoint until the issue is resolved.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Project Manager