CVE-2023-2744

WP ERP < 1.12.4 - Admin+ SQL Injection

published June 27, 2023

CVSS
—
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02632 · 85.4th percentile
Published
2023-06-27T13:17Z
EPSS history
Timeline
  • 27 JUN 13:17Z
    WP ERP < 1.12.4 - Admin+ SQL Injection
    cvelistv5