WordPress Vulnerabilities

WordPress 1.0-3.8.1 - Authenticated Admin Blind SQL Injection

Description

The vulnerable line in question is line 230 of wp-includes/bookmark.php (in WordPress 3.8.1).

Affects WordPress

3.8.1
Fixed in WordPress 3.8.2

References

URL
https://advisories.dxw.com/advisories/sqli-in-wordpress-3-6-1/

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Original Researcher
Mallory Adams
Verified
No
WPVDB ID
9de7f82f-e3a2-4210-b3e1-d122050eb3bd

Timeline

Publicly Published
2014-03-17 (about 12 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2020-01-03 (about 6 years ago)

Other

Published
Title
Published
2024-12-24
Title
Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking < 2.15.4 - Authenticated (Subscriber+) SQL Injection
Published
2023-12-21
Title
MF Gig Calendar <=1.2.1 - Authenticated(Contributor+) SQL Injection
Published
2011-02-08
Title
Cdnvote < 0.4.2 - Multiple SQL Injections
Published
2022-12-09
Title
LetsRecover < 1.2.0 - Admin+ SQLi
Published
2025-05-08
Title
SMS Alert Order Notifications – WooCommerce < 3.8.2 - Unauthenticated SQL Injection