CVE-2021-4134CWE-89

Fancy Product Designer <= 4.7.4 Admin+ SQL Injection

High · published February 16, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
73.0
In the wild
Unconfirmed
What it is

The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01440 · 73.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-02-16T16:38Z
EPSS history
Timeline
  • 16 FEB 16:38Z
    Fancy Product Designer <= 4.7.4 Admin+ SQL Injection
    cvelistv5