CVE-2021-25070 WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi

2022-03-2817:22:09

CWE-89

WPScan

www.cve.org

wordpress

sql injection

unauthenticated

EPSS

0.002

Percentile

54.5%

JSON

The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue

CNA Affected

[
  {
    "product": "Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "6.88",
        "status": "affected",
        "version": "6.88",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f

EPSS

0.002

Percentile

54.5%

JSON

Related for CVELIST:CVE-2021-25070