WordPress Plugin Vulnerabilities

WP Cookie User Info < 1.0.9 - Admin+ SQL Injection

Description

The plugin does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection

Proof of Concept

Affects Plugins

Plugin icon
wp-cookie-user-info
Fixed in 1.0.9

References

CVE
CVE-2021-24858

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Shreya Pohekar of Codevigilant Project
Verified
Yes
WPVDB ID
9bd1c040-09cc-4c2d-88c9-8406a653a48b

Timeline

Publicly Published
2021-12-27 (about 4 years ago)
Added
2021-12-27 (about 3 years ago)
Last Updated
2022-04-16 (about 3 years ago)

Other

Published
Title
Published
2025-04-05
Title
Broken Link Checker by AIOSEO < 1.2.4 - Authenticated (Contributor+) SQL Injection
Published
2024-06-21
Title
Zoho Marketing Automation < 1.2.8 - Authenticated (Contributor+) SQL Injection
Published
2014-08-01
Title
Js-appointment <= 1.5 - SQL Injection
Published
2023-06-26
Title
AN_GradeBook <= 5.0.1 - Subscriber+ SQLi
Published
2025-08-15
Title
tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection