CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode.
Explanation of Vulnerability in Simple Terms
TARIFFUXX versions 1.4 and earlier contain a SQL injection vulnerability in database query handling. An attacker with low-level user access can craft malicious input to read sensitive data from the database without modifying or deleting records. The vulnerability requires network access and valid user credentials but no additional user interaction.
What an attacker can do
Read sensitive data from the database by injecting SQL commands into user input fields.
Potential impact on your site
Unauthorized access to sensitive database records, including user data, configuration, or other stored information.
Conditions required to exploit
Valid user account with low-level privileges; network access to the application.
Key dates
External resources
