What the vulnerability does
01Description
A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The I Recommend This Plugin contains a SQL injection vulnerability in versions 3.7.0 and earlier. An authenticated user with low privileges can inject malicious SQL code through unfiltered input, potentially reading or modifying database contents. The vulnerability requires valid site access but no special user interaction.
What an attacker can do
03Attacker Capabilities
Read or modify database records, including user data and site configuration.
Potential impact on your site
04Site Impact
Unauthorized access to sensitive database information; potential data corruption or user account compromise.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
April 20, 2023
CVE published
August 6, 2024
Record updated
