Affiliate Program Suite plugin SQL injection exposes database data
A WordPress affiliate program plugin can leak database data to attackers.
Summary
The Affiliate Program Suite (SliceWP Affiliates) WordPress plugin does not properly escape the email parameter, so an unauthenticated attacker can extract sensitive data from the database. All versions up to and including 1.2.14 are affected.
Affected when
- WooCommerce My Account registration enabled
What to do
No fixed version is named. Check that you run a version newer than 1.2.14 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen