Description
The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Mediamatic – Media Library Folders | 2.8.1 – < 2.8.1 | 2.8.1 |