CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Explanation of Vulnerability in Simple Terms
The CM Popup Plugin for WordPress versions up to 1.5.10 contains a SQL injection vulnerability in database queries. An authenticated user with low privileges can craft malicious input to extract sensitive data from the WordPress database or modify records. The vulnerability requires a valid WordPress account but no additional user interaction.
What an attacker can do
Read or modify data in the WordPress database, including user credentials and site configuration.
Potential impact on your site
Attackers with basic WordPress access can steal user data, modify site content, or compromise admin accounts.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
