CVE-2023-51469 WordPress Checkout Mestres WP Plugin <= 7.1.9.6 is vulnerable to SQL Injection

2023-12-3117:46:57

CWE-89

Patchstack

www.cve.org

cve-2023-51469

wordpress

sql injection

CVSS3

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "checkout-mestres-wp",
    "product": "Checkout Mestres WP",
    "vendor": "Mestres do WP",
    "versions": [
      {
        "lessThanOrEqual": "7.1.9.6",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/checkout-mestres-wp/wordpress-checkout-mestres-wp-plugin-7-1-9-6-unauthenticated-sql-injection-vulnerability?_s_id=cve