myCred < 2.3 - Subscriber+ SQL Injection
25Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendepss 1.3%
from disclosure to weapon
Published on NVDNov 29
VulnCheckNov 1
exploitation probability
1.3%top 32% of all CVEs
observed exploitation
yesVulnCheck
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user