VulnerabilityModified
CVE-2012-5350
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.
MEDIUM 6.0EPSS 2.37%
Does this matter?
Lower severity and a low EPSS score (2.37%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 2.37% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- wordpress/pay-with-tweet
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/47475Vendor Advisory
- http://wordpress.org/extend/plugins/pay-with-tweet/changelog/
- http://www.exploit-db.com/exploits/18330Exploit
- http://www.osvdb.org/78204
- http://www.securityfocus.com/bid/51308Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72165
- http://secunia.com/advisories/47475Vendor Advisory
- http://wordpress.org/extend/plugins/pay-with-tweet/changelog/
- http://www.exploit-db.com/exploits/18330Exploit
- http://www.osvdb.org/78204
- http://www.securityfocus.com/bid/51308Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72165
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.