CVE-2017-12946 Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection
HighCVSS 7.2
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress easy-modal(WordPress) | < 2.1.0 | 2.1.0 |
| easymodal project easy modal | <= 2.0.17 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.defensecode.com third-party-advisory
- wordpress.org third-party-advisory