CVE-2021-24844

Affiliate Manager < 2.8.7 - Admin+ SQL injection

EPSS 1.5%CWE-89

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue

Affected products

Unknown · Affiliates Manager

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://plugins.trac.wordpress.org/changeset/2611862/https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0d