CVEvulnerability
CVE-2021-24727
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
Affected configurations
• billminozzi stop bad bots (< 6.60)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://plugins.trac.wordpress.org/changeset/2576276/ Third Party Advisory
- https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c Exploit, Third Party Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174 Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2576276/ Third Party Advisory
- https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c Exploit, Third Party Advisory
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174 Exploit, Third Party Advisory