CVE-2016-0769

HIGH 8.8 CVSS 3.0

Published: January 23, 2017
Last modified: June 17, 2026
NVD status: Modified
Reported by: secalert@redhat.com
Weakness: CWE-89
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.

Affected products and versions

n/a n/a — Versions not specified
elfden eshop_plugin — Version 6.3.14

References

www.openwall.com http://www.openwall.com/lists/oss-security/2016/02/02/3 Exploit, Third Party Advisory
www.securityfocus.com http://www.securityfocus.com/bid/82347 Third Party Advisory, VDB Entry
www.vapid.dhs.org http://www.vapid.dhs.org/advisory.php?v=160 Exploit, Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References