Lucene search

WPScanCVE-2024-6926

HistorySep 04, 2024 - 6:15 a.m.

CVE-2024-6926

2024-09-0406:15:17

WPScan

web.nvd.nist.gov

viral signup

wordpress

sql injection

unauthenticated users

ajax action

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.2%

JSON

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected configurations

Vulners

Vulnrichment

Node

lapostalaposta_signup_basicRange≤2.1wordpress

VendorProductVersionCPE
lapostalaposta_signup_basic*cpe:2.3:a:laposta:laposta_signup_basic:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
laposta	laposta_signup_basic	*	cpe:2.3:a:laposta:laposta_signup_basic::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Viral Signup",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "2.1"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

wpscan.com/vulnerability/9ce96ce5-fcf0-4d7a-b562-f63ea3418d93/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.2%

JSON

Related for CVE-2024-6926