Description
The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Relevanssi | < 4.26.0 | 4.26.0 |
| — | Relevanssi Premium | < 2.29.0 | 2.29.0 |
References
- https://wpscan.com/vulnerability/bd8e27c7-8f97-4313-b16e-50ac6f0676f5/ exploit vdb-entry technical-description