CVE-2015-4064 WordPress Landing Pages <= 1.8.4 - Authenticated SQL Injection

MediumCVSS 6.5 EPSS 3.8% Public exploit

Published: 2015-05-27 21:00
Updated: 2026-06-17 03:26
Exploit status: Public exploit available

Description

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.

Affected products

Product	Affected versions	Fixed in
landing pages project landing pages	<= 1.8.4	No fix listed
wordpress landing-pages(WordPress)	< 1.8.5	1.8.5

References

packetstormsecurity.com exploit
74777 vdb-entry
wordpress.org patch vendor-advisory
37108 exploit
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v2.0

6.5 Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

All scores (2)

v3.1 8.8 · wordfence
v2.0 6.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 3.82% (percentile 90.2)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities Exploit · Exploit Database (OffSec) · 2015-05-26