← CVE Intelligence

CVE-2023-6373

ArtPlacer Widget < 2.20.7 - Editor+ SQLi PUBLISHED

Description (CNA)

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)

Affected (CNA)

Vendor / productVersions
Unknown / ArtPlacer Widgetaffected 0 before 2.20.7

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.