CVE-2025-4578

The File Provider WordPress plugin (versions up to and including 1.2.3 ) is vulnerable to unauthenticated SQL injection . The root cause is the insufficient sanitization and escaping of the fileId parameter before its use in a SQL statement within an AJAX action. An unauthenticated attacker can a...