CVE-2023-49752CWE-89

WordPress Adifier System Plugin < 3.1.4 is vulnerable to SQL Injection

Critical · published December 20, 2023

CVSS v3.1
9.3
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection in the Adifier theme could let attackers manipulate your database with just a crafted command! 🔥 Think of it like a restaurant where a customer can sneak in their own special orders without the kitchen checking the menu properly — they could easily serve up whatever they want! With this vulnerability, an attacker could execute harmful SQL commands, potentially exposing or altering sensitive data, taking over admin controls, or even wiping your entire classified ads database. The risks are catastrophic!

Put simply

Think of it like a restaurant where a customer can sneak in their own special orders without the kitchen checking the menu properly — they could easily serve up whatever they want! This vulnerability allows improper neutralization of special elements in SQL commands, enabling an attacker to craft malicious inputs to manipulate the database through the Adifier theme — like slipping in a secret ingredient that changes the whole dish!

What to do

With this vulnerability, an attacker could execute harmful SQL commands, potentially exposing or altering sensitive data, taking over admin controls, or even wiping your entire classified ads database. The risks are catastrophic! Update to Adifier version 3.1.4 right away to patch this security hole. Additionally, review and sanitize all database queries to ensure no unsafe inputs are executed. Don't delay on this, as your site’s security is at stake! You’ve got this! Stay vigilant and proactive, and your site will be safer in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00588 · 47.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-12-20T17:38Z
EPSS history
Timeline
  • 20 DEC 17:38Z
    WordPress Adifier System Plugin < 3.1.4 is vulnerable to SQL Injection
    cvelistv5