WordPress CVEs

Description

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

Affected WordPress components

• Zero Spam for WordPress Plugin · zero-spam
  Confirmed match Active
  Before 5.2.11
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown WordPress Zero Spam — From 5.2.11 (including) to 5.2.11 (excluding)
• highfivery zero-spam — Before 5.2.11

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2660225 Patch, Third Party Advisory
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2680906 Patch, Third Party Advisory
• wpscan.com https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record