CVE-2023-6373

ArtPlacer Widget < 2.20.7 - Editor+ SQLi

High · published January 16, 2024

CVSS v3.1
8.8
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Published
2024-01-16T15:57Z
EPSS history
Timeline
  • 16 JAN 15:57Z
    ArtPlacer Widget < 2.20.7 - Editor+ SQLi
    cvelistv5