WordPress CVEs

Description

Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) cdnvote_post_id or (2) cdnvote_point parameter.

Affected WordPress components

• cdnvote Plugin · cdnvote
  Confirmed match Homeless
  Versions not specified; Up to and including 0.4.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• cdnvote_project cdnvote — Up to and including 0.4.1

References

• wpsecure.net http://wpsecure.net/2011/02/cdnvote-plugin/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/350873/cdnvote/trunk/cdnvote-post.php
• www.htbridge.com https://www.htbridge.com/advisory/HTB22845 Exploit
• nvd.nist.gov Official NVD record