WordPress Plugin Vulnerabilities

Hide My WP < 6.2.4 - Unauthenticated SQL Injection

Description

The plugin does not escape the IP address (retrieved via headers such as X-Forwarded-For) before using it in a SQL statement, leading to an SQL injection

Affects Plugins

Plugin icon
hide_my_wp
Fixed in 6.2.4

References

CVE
CVE-2021-36916

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Verified
No
WPVDB ID
eccce0de-0752-4ede-a0ab-de58cb868899

Timeline

Publicly Published
2021-11-24 (about 2 years ago)
Added
2021-11-24 (about 2 years ago)
Last Updated
2022-04-10 (about 2 years ago)

Other

Published
Title
Published
2022-12-05
Title
Contest Gallery < 19.1.5 - Author+ SQL Injection
Published
2014-08-01
Title
fMoblog 2.1 - (id) SQL Injection
Published
2015-10-06
Title
Support Ticket System <= 1.2 - Unauthenticated SQL Injection
Published
2021-05-27
Title
Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection
Published
2022-03-16
Title
WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi