Description
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Social Web Suite | ≤ 4.1.12 | — |
References
- https://wpscan.com/vulnerability/79204810-fd42-479d-bd2f-8762210f0fc5/ exploit vdb-entry technical-description