High · 7.7 CVE-2024-12015 EUVD-2024-50537GHSA-r6cg-rqqp-3rqx

SQL Injection in WordPress Project Manager Plugin

Published Dec 2, 2024 · Updated Dec 2, 2024 · Assigned by tenable

Vendor: wedevs Product: WP Project Manager Category: Web / CMS

Description

The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.

Affected products

Vendor	Product	Affected	Fixed
WeDevs	WP Project Manager	—	—

References

https://www.tenable.com/security/research/tra-2024-47