CVE-2021-24727

Block and Stop Bad Bots < 6.60 - Authenticated SQL Injections

The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections

Affected

WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.71% chance of exploitation in the next 30 days, 77th percentile

Published

2021-09-13

Updated

2024-08-03

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=291…

Security advisories

• https://plugins.trac.wordpress.org/changeset/2576276

References

• CVE Record
• NVD entry