CVE-2023-0381

GigPress <= 2.3.28 - Subscriber+ SQLi

The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks

Affected

GigPress

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

1.30% chance of exploitation in the next 30 days, 70th percentile

Published

2023-02-27

Updated

2025-03-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/39c964fa-6d8d-404d-ac38-72f6f88d203c

References

• CVE Record
• NVD entry