CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
Explanation of Vulnerability in Simple Terms
Ultimate WP Mail versions up to 1.3.4 contain a SQL injection vulnerability in database queries. An attacker with low-level site access can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability requires authentication but can affect the entire site.
What an attacker can do
Extract sensitive data from the site database or cause the site to become unavailable.
Potential impact on your site
Attackers with basic site access can read private posts, user data, or crash the database; immediate patching required.
Conditions required to exploit
Attacker must have a low-level user account (subscriber, contributor, or equivalent) on the WordPress site.
Key dates
External resources
Related vulnerabilities
