What the vulnerability does
01Description
A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.
Explanation of Vulnerability in Simple Terms
02Summary
The 404like Plugin contains a SQL injection vulnerability in its query handling. An attacker can inject malicious SQL commands through user-supplied input without authentication. This allows reading, modifying, or deleting database records. The vulnerability affects all versions from 1.0.0 onward.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records by injecting SQL commands.
Potential impact on your site
04Site Impact
Database contents can be compromised, including user credentials and site data.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 20, 2023
CVE published
August 6, 2024
Record updated
