CVE-2021-24758

The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.29% chance of exploitation in the next 30 days, 68th percentile

Published

2021-11-17

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8dd70db4-5845-440d-8b1d-012738abaac2

References

• CVE Record
• NVD entry

Related

• CVE-2021-24757
• CVE-2021-24759
• CVE-2021-24756
• CVE-2021-24760
• CVE-2021-24755
• CVE-2021-24761