CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.3.19.
Explanation of Vulnerability in Simple Terms
The Multiple Page Generator Plugin for WordPress contains a SQL injection vulnerability in versions up to 3.3.19. An authenticated administrator can inject malicious SQL code through plugin parameters, potentially reading sensitive database information. The vulnerability requires high-level admin access and does not allow data modification, but can expose confidential site data and cause service disruption.
What an attacker can do
Read sensitive data from the WordPress database, including user information and site configuration.
Potential impact on your site
An admin account compromise could expose your database contents; update the plugin immediately.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
