CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through <= 1.3.
Explanation of Vulnerability in Simple Terms
WP Music Player versions 1.3 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or equivalent access can inject malicious SQL commands to read sensitive database information. The vulnerability affects database confidentiality and may impact site availability. Update to a version newer than 1.3.
What an attacker can do
Read sensitive data from the site database and potentially degrade site performance.
Potential impact on your site
A compromised admin account could expose your database contents and cause performance issues.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
