CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.
Explanation of Vulnerability in Simple Terms
WordPress Local SEO plugin versions 2.3 and earlier contain a SQL injection vulnerability in database queries. An attacker can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the site's database or disrupting availability. No authentication is required to exploit this flaw.
What an attacker can do
Execute arbitrary SQL commands to read or modify database contents without authentication.
Potential impact on your site
Attackers can steal user data, passwords, and site configuration; disrupt site availability.
Conditions required to exploit
Network access to the WordPress site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
