CVE-2021-24727

The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.71% chance of exploitation in the next 30 days, 76th percentile

Published

2021-09-13

Updated

2024-08-03

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=291…

References

• CVE Record
• NVD entry

Related

• CVE-2021-24726
• CVE-2021-24728
• CVE-2021-24725
• CVE-2021-24729
• CVE-2021-24724
• CVE-2021-24730