CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sophia M Williams WP Contest wp-contest allows SQL Injection.This issue affects WP Contest: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
WP Contest versions 1.0.0 and earlier contain a SQL injection vulnerability accessible to authenticated users with low privileges. An attacker can craft malicious input to extract sensitive data from the site database, including user credentials and configuration details. The vulnerability affects the entire application scope due to database access. No user interaction is required once the attacker is logged in.
What an attacker can do
Read sensitive data from the site database, including user information and site configuration.
Potential impact on your site
User data and site configuration may be exposed to any authenticated user, even those with minimal permissions.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role) on the WordPress site.
Key dates
External resources
Related vulnerabilities
