CVE-2021-24844

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.53% chance of exploitation in the next 30 days, 73th percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0d

References

• CVE Record
• NVD entry

Related

• CVE-2021-24843
• CVE-2021-24845
• CVE-2021-24842
• CVE-2021-24846
• CVE-2021-24841
• CVE-2021-24847