PT-2025-7383 · WordPress · Wpexperts Square For Givewp

Frissi0N · Published 2025-02-21 · Updated 2025-02-21 · CVE-2024-13713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPExperts Square For GiveWP plugin for WordPress versions up to, and including, 1.3.1

Description The issue allows authenticated attackers with Subscriber-level access and above to perform SQL Injection via the post parameter due to insufficient escaping and lack of preparation on the existing SQL query. This enables attackers to extract sensitive information from the database by appending additional SQL queries to existing ones.

Recommendations For WPExperts Square For GiveWP plugin for WordPress versions up to, and including, 1.3.1, consider restricting access to the post parameter in the affected API endpoint until a patch is available. As a temporary workaround, avoid using the post parameter in queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-13713

Affected Products

Wpexperts Square For Givewp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-13713 · Security Note
• https://plugins.trac.wordpress.org/changeset/3242658/wpexperts-square-for-give/trunk/includes/class-give-square.php · Patch
• https://osv.dev/vulnerability/CVE-2024-13713 · Vendor Advisory
• https://twitter.com/CVEnew/status/1892898699476337107 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7863c5fb-1eda-41a3-b8ec-054784ab2438?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpexperts-square-for-give/trunk/includes/class-give-square.php#L189 · Note
• https://t.me/cvedetector/18649 · Telegram Post