What the vulnerability does
01Description
A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
Explanation of Vulnerability in Simple Terms
02Summary
The Editorial Calendar Plugin contains a SQL injection vulnerability in versions 2.0 and earlier. An authenticated user with low privileges can inject malicious SQL code through unfiltered input, potentially reading, modifying, or deleting database records. This affects confidentiality, integrity, and availability of site data.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records by injecting SQL code through the plugin.
Potential impact on your site
04Site Impact
Unauthorized users with basic site access can compromise your database, exposing or altering posts, user data, and settings.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., contributor or subscriber role).
Key dates
06Disclosure timeline
April 8, 2023
CVE published
August 6, 2024
Record updated
