Description
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Datalist it | ≤ 0.0.3 | — |
References
- https://wpscan.com/vulnerability/27135434-79e0-4f9e-aecf-c7092faec29b/ exploit vdb-entry technical-description