CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.
Explanation of Vulnerability in Simple Terms
UpsellWP versions 2.2.4 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or equivalent access can inject malicious SQL code through unfiltered input, potentially reading sensitive database records. The vulnerability also impacts site availability. Update to a version newer than 2.2.4.
What an attacker can do
Read sensitive data from the site database and cause partial service disruption.
Potential impact on your site
A compromised admin account could expose customer data, orders, or configuration stored in your database.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the site.
Key dates
External resources
Related vulnerabilities
