blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24727

HIGH 8.8 CVSS 3.1
Published
September 13, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections

Affected products and versions

  • Unknown WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots — From 6.60 (including) to 6.60 (excluding)
  • billminozzi stop_bad_bots — Before 6.60

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2576276/ Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c Exploit, Third Party Advisory
  • www.trustwave.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record