VulnerabilityModified
CVE-2021-24844
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
HIGH 7.2EPSS 1.53%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.53% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- wpaffiliatemanager/affiliates manager
- Source
- contact@wpscan.com
References
- https://plugins.trac.wordpress.org/changeset/2611862/Patch, Third Party Advisory
- https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0dExploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2611862/Patch, Third Party Advisory
- https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0dExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.