Beveiligingsadvies

CVE-2021-24846

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2021-12-21 08:45:31

Laatst bijgewerkt 2024-08-03 19:42:17

Toegewezen door WPScan

CVSS-score geen score

Status PUBLISHED

Beschrijving

The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber

← Alle CVE's bekijken Bekijk op cve.org ↗