Description
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WordPress Zero Spam | 5.2.11 – < 5.2.11 | 5.2.11 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | bmarshall511/wordpress_zero_spam | < 5.2.13 | 5.2.13 | GHSA-pq2f-3fg3-rw99 |