CVE-2023-26015

2023-11-0313:15:08

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-26015

sql injection

chris richardson

mappress maps

wordpress

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.8%

JSON

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.

Affected configurations

Vulners

NVD

Node

chris_richardsonmappress_maps_for_wordpressRange≤2.85.4

CPENameOperatorVersion
mappresspro:mappress_maps_for_wordpressmappresspro mappress maps for wordpressle2.85.4

CPE	Name	Operator	Version
mappresspro:mappress_maps_for_wordpress	mappresspro mappress maps for wordpress	le	2.85.4

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "mappress-google-maps-for-wordpress",
    "product": "MapPress Maps for WordPress",
    "vendor": "Chris Richardson",
    "versions": [
      {
        "changes": [
          {
            "at": "2.85.5",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.85.4",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/mappress-google-maps-for-wordpress/wordpress-mappress-maps-for-wordpress-plugin-2-85-4-authenticated-sql-injection-vulnerability?_s_id=cve