CVE-2021-24877CWE-89
MainWP Child < 4.1.8 - Admin+ SQL Injection
published November 23, 2021
What it is
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.01279 · 69.8th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2021-11-23T19:16Z
EPSS history
Timeline