Skip to content
OpenAdvisories
Unscored CVE-2021-24140 EUVD-2021-11054GHSA-w9hc-cq6j-8gqw

Ajax Load More < 5.3.2 - Authenticated SQL Injection

Published Mar 18, 2021 · Updated Aug 3, 2024 · Assigned by WPScan

Description

Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.

Affected products

VendorProductAffectedFixed
— Ajax Load More 5.3.2 – < 5.3.2 5.3.2

References