CVE-2009-4748

HIGH 7.5 CVSS 2.0

Published: March 26, 2010
Last modified: June 16, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-89
CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

Affected products and versions

n/a n/a — Versions not specified

References

packetstormsecurity.org http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt
www.exploit-db.com http://www.exploit-db.com/exploits/9150
www.securityfocus.com http://www.securityfocus.com/bid/35704 Exploit
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/51727
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References