CVE-2011-4646 WP-PostRatings <= 1.61 - SQL Injection
MediumCVSS 6.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lesterchan wp-postratings | = 1.50 | No fix listed |
| lesterchan wp-postratings | = 1.61 | No fix listed |
| wordpress wp-postratings(WordPress) | < 1.62 | 1.62 |
References
- plugins.trac.wordpress.org exploit patch
- 46328 third-party-advisory vendor-advisory
- wordpress.org
- 49986 vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org