CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor-and-classic-widgets allows SQL Injection.This issue affects Classic Editor and Classic Widgets: from n/a through <= 1.4.1.
Explanation of Vulnerability in Simple Terms
WP Grim Classic Editor and Classic Widgets versions up to 1.4.1 contain a SQL injection vulnerability. An attacker with low-level user privileges can craft malicious input to execute arbitrary SQL queries against the site database. This can expose sensitive data and disrupt site availability. Update to a version newer than 1.4.1.
What an attacker can do
Execute SQL queries to read or modify the site database, exposing user data and disrupting functionality.
Potential impact on your site
User data, posts, and settings could be exposed or deleted; site may become unstable or inaccessible.
Conditions required to exploit
Attacker must have a low-privilege user account (subscriber or contributor level) on the WordPress site.
Key dates
External resources
Related vulnerabilities
