CVEvulnerability
CVE-2011-4646
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-11-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.
Affected configurations
• lesterchan wp-postratings 1.50
• lesterchan wp-postratings 1.61
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://plugins.trac.wordpress.org/changeset/430970/wp-postratings/trunk/wp-postratings.php?old=355076&old_path=wp-postratings%2Ftrunk%2Fwp-postratings.php Exploit, Patch
- http://secunia.com/advisories/46328 Vendor Advisory
- http://wordpress.org/extend/plugins/wp-postratings/changelog/ wordpress.org
- http://www.securityfocus.com/bid/49986 www.securityfocus.com
- http://plugins.trac.wordpress.org/changeset/430970/wp-postratings/trunk/wp-postratings.php?old=355076&old_path=wp-postratings%2Ftrunk%2Fwp-postratings.php Exploit, Patch
- http://secunia.com/advisories/46328 Vendor Advisory
- http://wordpress.org/extend/plugins/wp-postratings/changelog/ wordpress.org
- http://www.securityfocus.com/bid/49986 www.securityfocus.com