CVE-2023-5203

WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

High · published December 26, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
82.4
In the wild
Unconfirmed
What it is

The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02202 · 82.4th percentile
Published
2023-12-26T18:33Z
EPSS history
Timeline
  • 26 DEC 18:33Z
    WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection
    cvelistv5