Login Lockdown < 2.07 - Admin+ SQLi

2024-01-0500:00:00

wpscan.com

sql injection

admin privilege

security exploit

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

Description The plugin does not properly sanitise and escape the iDisplayStart parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

References

patchstack.com/database/vulnerability/login-lockdown/wordpress-login-lockdown-protect-login-form-plugin-2-06-sql-injection-vulnerability