CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability in 404 Redirection Manager allows unauthenticated attackers to read or modify database contents through malicious input. The vulnerability requires no user interaction and can be exploited over the network. Attackers can extract sensitive data or alter site configuration without authentication.
What an attacker can do
Read or modify the site database without logging in.
Potential impact on your site
Attackers can steal user data, modify redirects, or corrupt the database without any credentials.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
