CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solwininfotech WP Social Stream Designer social-stream-design allows Blind SQL Injection.This issue affects WP Social Stream Designer: from n/a through <= 1.3.
Explanation of Vulnerability in Simple Terms
WP Social Stream Designer versions 1.3 and earlier contain a SQL injection vulnerability in a high-privilege function. An authenticated administrator can inject malicious SQL queries through an unvalidated input parameter. The vulnerability allows reading sensitive database contents and may affect other site components due to scope change. No code execution or data modification is possible through this flaw.
What an attacker can do
Read sensitive data from the site's database if they have administrator access.
Potential impact on your site
An admin account compromise could expose your database contents, though data modification is not possible through this vulnerability.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
