Mail Mage WordPress plugin unauthenticated SQL injection
A WordPress mail plugin lets anyone without a login peek at or change its database.
Summary
The Mail Mage WordPress plugin does not properly sanitise a user-supplied value used in an SQL statement, letting unauthenticated attackers perform SQL injection. Versions through 0.0.25 are affected.
What to do
No known fix exists yet. If you run 0.0.25 or older, check that you run a newer version and read the WPScan advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen