CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.
Explanation of Vulnerability in Simple Terms
Workreap contains a SQL injection vulnerability in its plugin code that allows authenticated users to read sensitive data from the site's database and potentially disrupt service. The vulnerability requires a valid user account but no additional user interaction. An attacker with low privileges can extract confidential information or cause partial availability issues across the affected site.
What an attacker can do
Read sensitive data from the database and cause partial service disruption.
Potential impact on your site
Confidential data (user info, posts, settings) may be exposed; site performance may degrade.
Conditions required to exploit
Attacker must have a valid user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
