Description
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Taskbuilder | < 3.0.5 | 3.0.5 |
References
- https://wpscan.com/vulnerability/eb2d0932-fd47-4aef-9d08-4377c742bb6e/ exploit vdb-entry technical-description