CVE-2024-49246CWE-89

WordPress Ajax Rating with Custom Login plugin <= 1.1 - SQL Injection vulnerability

Critical · published October 17, 2024

CVSS v3.1
9.3
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection vulnerability is lurking in Ajax Rating with Custom Login, and it could let attackers manipulate your database with ease! 🔥 Think of this vulnerability like a restaurant that allows customers to change their orders by simply saying 'I want this instead,' without verifying what's actually on the menu. It’s a recipe for disaster—anyone could sneak in a dish they shouldn’t have access to! If exploited, an attacker could gain unauthorized access to your database, allowing them to read, modify, or even delete data at will. This could lead to devastating data breaches, reputation damage, and loss of trust from your users. In a world where data is gold, losing control is absolutely catastrophic!

Put simply

Think of this vulnerability like a restaurant that allows customers to change their orders by simply saying 'I want this instead,' without verifying what's actually on the menu. It’s a recipe for disaster—anyone could sneak in a dish they shouldn’t have access to! This SQL injection vulnerability resides in the 'sql' command input of Ajax Rating with Custom Login, allowing attackers to inject malicious SQL queries through improperly sanitized inputs. This can result in unauthorized database access and full manipulation capabilities by the attacker.

What to do

If exploited, an attacker could gain unauthorized access to your database, allowing them to read, modify, or even delete data at will. This could lead to devastating data breaches, reputation damage, and loss of trust from your users. In a world where data is gold, losing control is absolutely catastrophic! Immediate action is crucial: update to the latest version of Ajax Rating with Custom Login, which addresses this SQL injection vulnerability. Implement prepared statements and input validation to ensure that user inputs are safely handled and cannot compromise your database. Don't wait—secure your application now! You've got this! By following these steps, you'll strengthen your defenses and keep your data safe. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-10-17T17:31Z
EPSS history
Timeline
  • 17 OCT 17:31Z
    WordPress Ajax Rating with Custom Login plugin <= 1.1 - SQL Injection vulnerability
    cvelistv5