Description (CNA)
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Testimonial WordPress Plugin – AP Custom Testimonial | affected 1.4.6 before 1.4.6*; affected 1.4.7 before 1.4.7 |
CWE
CWE-89
References
- https://wpscan.com/vulnerability/77fd6749-4fb2-48fa-a191-437b442f28e9
- https://plugins.trac.wordpress.org/changeset/2664185
ADP enrichment
No English description supplied.