CVE-2024-50491CWE-89

WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability

Critical · published October 28, 2024

CVSS v3.1
9.3
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

🚨 SQL injection is back, and it’s lurking in MicahBlu RSVP ME! With a critical flaw in versions up to 1.9.9, attackers could manipulate your database without breaking a sweat. 🔥 Think of it like a restaurant where a diner can sneak a note to the chef, changing their order to something completely unexpected. If the chef doesn’t double-check those notes, they could be cooking up a storm of trouble! An attacker could potentially gain complete control over the application's database, allowing them to read, modify, or even delete sensitive data. This could lead to a complete compromise of your system’s integrity – leaving your users and data exposed!

Put simply

Think of it like a restaurant where a diner can sneak a note to the chef, changing their order to something completely unexpected. If the chef doesn’t double-check those notes, they could be cooking up a storm of trouble! This SQL injection vulnerability allows attackers to manipulate SQL commands, potentially bypassing authentication and accessing sensitive data stored in the database.

What to do

An attacker could potentially gain complete control over the application's database, allowing them to read, modify, or even delete sensitive data. This could lead to a complete compromise of your system’s integrity – leaving your users and data exposed! Immediately patch the application to version 2.0.0 or above to close this vulnerability. Additionally, review your SQL queries and ensure that they use prepared statements to defend against future attacks. You can handle this! With a quick update and a bit of vigilance, your application will be secure once more. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01024 · 63.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-10-28T12:37Z
EPSS history
Timeline
  • 28 OCT 12:37Z
    WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability
    cvelistv5