CVE-2021-24877 MainWP Child < 4.1.8 - Admin+ SQL Injection

2021-11-2319:16:17

CWE-89

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

37.8%

JSON

The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed

CNA Affected

[
  {
    "product": "MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.1.8",
        "status": "affected",
        "version": "4.1.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15

0.001 Low

EPSS

Percentile

37.8%

JSON

Related for CVELIST:CVE-2021-24877