Description
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Sessions Time Monitoring Full Automatic | < 1.0.9 | 1.0.9 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection http/cves/2023/CVE-2023-5203.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932 exploit vdb-entry technical-description