CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind SQL Injection.This issue affects Error Log Viewer: from n/a through <= 1.0.5.
Explanation of Vulnerability in Simple Terms
Error Log Viewer versions 1.0.5 and earlier contain a SQL injection vulnerability in the error log query handler. An attacker with low-level user access can inject malicious SQL to read sensitive database records, including user credentials and configuration data. The vulnerability affects the entire database scope and may also cause service disruption.
What an attacker can do
Read sensitive database records including user credentials and site configuration by injecting SQL commands.
Potential impact on your site
Attackers with basic user accounts can extract passwords, email addresses, and other sensitive data from your database.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
