CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
Simple Code Insert Shortcode versions 1.0 and earlier contain a SQL injection vulnerability accessible to authenticated users. An attacker with low-level site access can craft malicious input through the shortcode to extract or modify database records. The vulnerability affects confidentiality severely and can degrade site availability.
What an attacker can do
Read or modify database records by injecting SQL commands through the shortcode.
Potential impact on your site
Sensitive data in your database could be exposed or altered; site performance may degrade.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
