Description

WordPress Plugin WP People is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Remediation

Update to the latest version

References

CVE-2008-0845 : SQL injection vulnerability in wp-people-popup.php in ...

SQL injection vulnerability in wp-people-popup.php in...

WP People <= 3.4.1 - SQL Injection - Wordfence

Related Vulnerabilities

WordPress Plugin Better Messages-Live Chat for WordPress, BuddyPress, BuddyBoss, Ultimate Member Multiple Vulnerabilities (1.9.9.37)

Moodle Configuration Vulnerability (CVE-2012-3392)

WordPress Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Vulnerability (CVE-2017-5493)

WordPress Plugin Picturesurf Gallery 'upload.php' Arbitrary File Upload (1.2)

WordPress Plugin Listing, Classified Ads & Business Directory-uListing Multiple Vulnerabilities (2.0.5)

Severity

High

Classification

CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection