CVE-2024-12015 HIGH

CVE-2024-12015: SQL Injection in WordPress Project Manager Plugin

Vendor Wedevs

Product WP Project Manager

Weakness CWE-89 · SQLi

Published December 2, 2024

Last update December 2, 2024

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.

Key dates

02Disclosure timeline

December 2, 2024 CVE published

December 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12015 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-0637 Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability CVE-2025-10802 code-projects Online Bidding System remove.php sql injection CVE-2025-6970 Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter CVE-2025-8923 code-projects Job Diary edit-details.php sql injection CVE-2025-6880 SourceCodester Best Salon Management System edit-tax.php sql injection