CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
Explanation of Vulnerability in Simple Terms
GeoDirectory versions up to 2.3.28 contain a SQL injection vulnerability in a database query that requires administrator privileges to exploit. An attacker with admin access can inject malicious SQL code to read sensitive data from the WordPress database. The vulnerability also affects site availability. Update to a version newer than 2.3.28.
What an attacker can do
Read sensitive data from the WordPress database if they have administrator access.
Potential impact on your site
An admin account compromise could expose your entire database contents, including user credentials and private business listings.
Conditions required to exploit
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
