Description (CNA)
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / WordPress Zero Spam | affected 5.2.11 before 5.2.11 |
CWE
CWE-89
References
- https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997
- https://plugins.trac.wordpress.org/changeset/2660225
- https://plugins.trac.wordpress.org/changeset/2680906
ADP enrichment
No English description supplied.