CVE-2020-8596 Participants Database <= 1.9.5.5 - SQL Injection
HighCVSS 7.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xnau Participants Database | <= 1.9.5.5 | No fix listed |
| wordpress participants-database(WordPress) | < 1.9.5.6 | 1.9.5.6 |
References
- blog.impenetrable.tech third-party-advisory
- wpvulndb.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org