CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
Explanation of Vulnerability in Simple Terms
Fluent Support versions up to 1.7.6 contain a SQL injection vulnerability in a database query that requires administrator privileges to exploit. An attacker with admin access can inject malicious SQL code to read sensitive data from the WordPress database. The vulnerability also impacts site availability. Update to a version newer than 1.7.6 to remediate.
What an attacker can do
Read sensitive data from the WordPress database; cause partial site unavailability.
Potential impact on your site
A compromised admin account can expose customer data, ticket information, and other database contents.
Conditions required to exploit
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
