WordPress Plugin Vulnerabilities

WP Postratings < 1.62 - Authenticated SQL Injection

Description

The WP-PostRatings WordPress plugin was affected by a SQL Injection security vulnerability allowing authenticated users (author+) to execute SQL commands via the id attribute of the ratings shortcode when creating a post

Affects Plugins

Plugin icon
wp-postratings
Fixed in 1.62

References

CVE
CVE-2011-4646

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
9.9 (critical)

Miscellaneous

Verified
No
WPVDB ID
6cc8b2ae-0b82-4d07-9a5d-1b6183306356

Timeline

Publicly Published
2011-10-06 (about 14 years ago)
Added
2019-08-23 (about 6 years ago)
Last Updated
2020-12-24 (about 5 years ago)

Other

Published
Title
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Authenticated Blind SQL Injection
Published
2025-02-23
Title
Wishlist < 1.0.42 - Authenticated (Contributor+) SQL Injection
Published
2022-05-02
Title
WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi
Published
2025-08-28
Title
iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter
Published
2026-02-11
Title
JS Help Desk < 3.0.2 - Authenticated (Subscriber+) SQL Injection