WordPress Hide My WP Plugin SQL Injection (CVE-2021-36916)

An SQL injection vulnerability exists in WordPress Hide My WP Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-36916

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-36917

WordPress Hide My WP plugin versions = 6.2.3 can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin...

CVE-2021-36917

WordPress Hide My WP plugin versions = 6.2.3 can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin...

CVE-2021-36916

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

Design/Logic Flaw

WordPress Hide My WP plugin versions = 6.2.3 can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin...

Sql injection

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-36916

CVE-2021-36916 : WordPress Hide My WP premium plugin

CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-36917 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability

WordPress Hide My WP plugin versions = 6.2.3 can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin...

CVE-2021-36917

CVE-2021-36917 affects the WordPress Hide My WP premium plugin (versions ≤ 6.2.3). The vulnerability allows an unauthenticated user to deactivate the plugin by abusing a reset token that can be retrieved and used to disable it. Impact stated in multiple sources centers on unauthorized deactivatio...

WordPress plugin Hide My WP 访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . An access control error vulnerability exists in the...

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by Dave Jong in WordPress Hide My WP premium plugin versions = 6.2.3. Solution Update the WordPress Hide My WP premium plugin to the latest available version at least 6.2.4...

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

Unauthenticated SQL injection SQLi vulnerability discovered by Dave Jong Patchstack in WordPress Hide My WP premium plugin versions = 6.2.3. Solution Update the WordPress Hide My WP premium plugin to the latest available version at least 6.2.4...

WordPress Hide My WP Ghost plugin <= 2.0.02 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Jonas Lejon in the WordPress Hide My WP Ghost plugin versions = 2.0.02. Solution Update the WordPress Hide My WP Ghost plugin to the latest available version at least 2.0.03...

Hide My WP <= 2.0.02 - SQL Injection & Script Injection

Versions below 2.0.03 are vulnerable for SQL Injection and Script Injection. Fixed in version 2.0.03 released on 2018-09-15...

Hide My WP <= 4.53 - Stored-Cross Site Scripting (XSS)

An attacker can make a fake attack attempt which will be logged, and can inject JavaScript. curl --referer 'you are using bad filtering for input ript alert"XSS here" ript; :; ;' http://example.com...

WordPress Hide My WP Plugin <= 4.53 - Cross Site Scripting

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...

Hide My WP <= 4.51.1 - Stored Cross-Site Scripting (XSS)

An attacker can make a fake attack attempt, with a JavaScripting payload, which will be logged by the plugin, resulting in XSS. The attacker also can spoof their IP address in the logs by setting the X-FORWARDED-FOR header. PoC curl --referer '...