CVE-2014-5182 YAWPP (Yet Another WordPress Petition Plugin) <= 1.2.1 - Authenticated SQL Injection
MediumCVSS 6.0
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter in the update action to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ostenta yawpp | = 1.2 | No fix listed |
| wordpress yawpp(WordPress) | < 1.2.2 | 1.2.2 |
References
- codevigilant.com exploit
- wordpress.org patch
- plugins.trac.wordpress.org exploit patch
- Wordfence Intelligence third-party-advisory
- www.cve.org