CVE-2021-24959

CVE-2021-24959: WP Email Users <= 1.7.6 - Subscriber+ SQL Injection

Vendor Unknown

Product WP Email Users

Weakness CWE-89 · SQLi

Published March 14, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.

Key dates

02Disclosure timeline

March 14, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24959 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html