Description
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ajax Load More | < 8.0.1 | 8.0.1 |
References
- https://wpscan.com/vulnerability/0b5c1dd6-8bb9-45f7-8237-84a43ef53ec4/ exploit vdb-entry technical-description