WordPress Brute Force Protection < 2.2.6 - Admin+ SQLi

2023-12-0800:00:00

wpscan.com

wordpress

brute force

protection

sqli

exploit

high privilege

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CPENameOperatorVersion
eq2.2.6

CPE	Name	Operator	Version
		eq	2.2.6

References

patchstack.com/database/vulnerability/guardgiant/wordpress-wordpress-brute-force-protection-stop-brute-force-attacks-plugin-2-2-5-sql-injection-vulnerability