CVE-2024-6666 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendorid’ and 'status' parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVE-2024-6666 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendorid’ and 'status' parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVE-2024-6666

WP ERP for WordPress is vulnerable to SQL Injection via vendor_id in versions up to 1.13.0. The flaw stems from insufficient escaping and query preparation, enabling authenticated attackers with Accounting Manager+ permissions (erp_ac_view_sales_summary) to inject additional SQL into existing que...

WordPress WP ERP Plugin <= 1.13.0 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.13.0 Fixed in 1.13.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6666 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 89623a7b5068 Credits Edwin Siebel edwinsiebel Required privilege Shop Manager...