CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
Explanation of Vulnerability in Simple Terms
The Most And Least Read Posts Widget for WordPress contains a SQL injection vulnerability in versions up to 2.5.16. An attacker with low-level WordPress access can craft malicious input to execute arbitrary SQL queries against the site database. This can expose sensitive data including user credentials and private content. A patched version has not been publicly identified.
What an attacker can do
Read or modify database contents, including user passwords and private posts, by injecting SQL commands.
Potential impact on your site
Unauthorized access to sensitive data, user credentials, and private content; potential data loss or corruption.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (subscriber or contributor level or higher).
Key dates
External resources
Related vulnerabilities
