Description (CNA)
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin | affected 3.1.0 through 3.1.0 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.