CVE-2023-6373 ArtPlacer Widget < 2.20.7 - Editor+ SQLi

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor or above...

CVE-2023-6373

CVE-2023-6373 affects the ArtPlacer Widget WordPress plugin prior to 2.20.7. The flaw is an SQL injection caused by unsanitized/unescaped id parameter used in a query, exploitable by editors (and above); CSRF absence can permit exploitation against a logged-in editor. In practice, this yields a h...

WordPress ArtPlacer Widget Plugin <= 2.20.6 is vulnerable to SQL Injection

Software ArtPlacer Widget Type Plugin Vulnerable versions = 2.20.6 Fixed in 2.20.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-6373 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 85dfadf12e68 Credits Claudio Marchesini Enrico Marcolini Required...