CVE-2021-24151

🗓️ 16 Jan 2024 15:48:54Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 29 Views🌐 WEB

The WP Editor WordPress plugin before 1.2.7 has an authenticated blind SQL injection issue

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2021-24151	23 Jan 202423:16	–	circl
CNNVD	WordPress plugin WP Editor security vulnerability	16 Jan 202400:00	–	cnnvd
Cvelist	CVE-2021-24151 WP Editor < 1.2.7 - Authenticated SQL injection	16 Jan 202415:48	–	cvelist
EUVD	EUVD-2021-11065	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24151	16 Jan 202416:15	–	nvd
Prion	Sql injection	16 Jan 202416:15	–	prion
Positive Technologies	PT-2024-10887 · WordPress · Wp Editor	16 Jan 202400:00	–	ptsecurity
RedhatCVE	CVE-2021-24151	22 May 202518:23	–	redhatcve
Vulnrichment	CVE-2021-24151 WP Editor < 1.2.7 - Authenticated SQL injection	16 Jan 202415:48	–	vulnrichment
wpexploit	WP Editor < 1.2.7 - Authenticated SQL injection	1 Feb 202100:00	–	wpexploit

NVD

Vulners

Node

benjaminrojas wp_editorRange<1.2.7wordpress

[
  {
    "vendor": "Unknown",
    "product": "WP Editor",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.2.7"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/5ee77dd7-5a73-4d4e-8038-23e6e763e20c/

Parameter	Position	Path	Description	CWE
cm0s	request body	wp-admin/admin-ajax.php	Authenticated (admin+) blind SQL injection via arbitrary parameter when saving settings in WP Editor plugin (vulnerable parameter: cm0s).	CWE-89
action	request body	wp-admin/admin-ajax.php	Authenticated (admin+) blind SQL injection via arbitrary parameter when saving settings in WP Editor plugin (vulnerable parameter: cm0s).	CWE-89
wp_editor_ajax_nonce_settings_main	request body	wp-admin/admin-ajax.php	Authenticated (admin+) blind SQL injection via arbitrary parameter when saving settings in WP Editor plugin (vulnerable parameter: cm0s).	CWE-89
submit	request body	wp-admin/admin-ajax.php	Authenticated (admin+) blind SQL injection via arbitrary parameter when saving settings in WP Editor plugin (vulnerable parameter: cm0s).	CWE-89

20 Jun 2025 17:15Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.2

EPSS0.00526

SSVC

CWE-89

cve-2021-24151 wp editor wordpress plugin blind sql injection nvd