CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.
Explanation of Vulnerability in Simple Terms
Houzez Real Estate WordPress Theme versions up to 1.3.4 contain a SQL injection vulnerability in a database query that accepts user input without proper sanitization. An attacker with low-level site access can craft malicious input to extract sensitive data, modify database records, or compromise site integrity. The vulnerability affects the entire site due to scope change.
What an attacker can do
Extract sensitive data from the database, modify or delete records, or potentially escalate privileges on the site.
Potential impact on your site
Database contents can be read or altered by any low-privilege user; site data and user information are at risk.
Conditions required to exploit
Attacker must have a low-level user account (subscriber or contributor role) on the WordPress site.
Key dates
External resources
Related vulnerabilities
