CVE-2023-0381

2023-02-2716:15:12

WPScan

web.nvd.nist.gov

cve-2023-0381

gigpress

wordpress

plugin

sql injection

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

38.3%

JSON

The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks

Affected configurations

Nvd

Vulners

Node

trigigpressRange≤2.3.28wordpress

VendorProductVersionCPE
trigigpress*cpe:2.3:a:tri:gigpress:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
tri	gigpress	*	cpe:2.3:a:tri:gigpress::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "GigPress",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "2.3.28"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]