CVE-2023-2201 Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id

🗓️ 02 Jun 2023 03:36:06Reported by WordfenceType

The WordPress plugin Web Directory Free is vulnerable to SQL Injection via the 'post_id' parameter, allowing authenticated attackers to extract sensitive database information

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2023-2201	2 Jun 202304:15	–	attackerkb
CNNVD	WordPress plugin Web Directory Free SQL注入漏洞	2 Jun 202300:00	–	cnnvd
CVE	CVE-2023-2201	2 Jun 202303:36	–	cve
EUVD	EUVD-2023-33714	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2201	2 Jun 202304:15	–	nvd
OSV	CVE-2023-2201	2 Jun 202304:15	–	osv
Patchstack	WordPress Web Directory Free Plugin <= 1.6.8 is vulnerable to SQL Injection	1 Jun 202300:00	–	patchstack
Prion	Sql injection	2 Jun 202304:15	–	prion
Positive Technologies	PT-2023-18361 · WordPress · Web Directory Free	2 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2201	23 May 202504:54	–	redhatcve

[
  {
    "vendor": "mihail-chepovskiy",
    "product": "Web Directory Free",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3023559/web-directory-free/trunk/search/plugin/classes/search/search_forms_manager.php
plugins	www.plugins.trac.wordpress.org/browser/web-directory-free/tags/1.6.8/search/plugin/classes/search/search_forms_manager.php
plugins	www.plugins.trac.wordpress.org/browser/web-directory-free/tags/1.6.6/search/plugin/classes/search/search_forms_manager.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d831fa81-4714-4757-b75d-0a8f5edda910

08 Apr 2026 17:26Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.00822

CWE-89