CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.
Explanation of Vulnerability in Simple Terms
WP Project Manager versions up to 2.6.0 contain a SQL injection vulnerability in database queries. An attacker with low-level user access can craft malicious input to extract sensitive data from the site's database, including user information and project details. The vulnerability affects multiple database operations and can impact site confidentiality and availability.
What an attacker can do
Extract sensitive data from the site database, including user credentials and project information.
Potential impact on your site
Unauthorized access to user data, project information, and potential site instability if the database is disrupted.
Conditions required to exploit
Attacker must have a low-level user account (subscriber or contributor role) on the WordPress site.
Key dates
External resources
Related vulnerabilities
